ksfraser/fa-product-attributes

Dependency profilecaution

Seven runtime dependencies create meaningful transitive maintenance and supply-chain surface for a package of this scope; the declared Composer dependency profile is visible, but the breadth warrants review and pinning.

Maintainerscaution

Only one registry account has publish access. This is a resilience concern for an independently owned package because publication continuity depends on a single account, though registry access is weaker evidence than actual repository activity.

Project backingcaution

The repository owner is an individual account, not an organization, so the single-maintainer and single-contributor risks are not visibly compensated by organizational backing.

Release historycaution

Only one release exists and the package is zero days old in the collected registry history, so there is no demonstrated release track record or long-term maintenance history.

Repo bus factorcaution

All 44 recent commits came from one contributor, producing a high bus-factor risk; the repository owner is an individual rather than an organization, so there is no provided project-backing evidence to compensate for this concentration.