libpurecontent/sinenomine

Dependency profilecaution

The package has 5 runtime dependencies and no development dependencies. This is a meaningful dependency surface, but the signal does not show that it is excessive or unmanaged.

Maintainerscaution

Only one registry account has publish access, which is a thin publishing base. However, the repository is organization-owned, so this is a modest resilience concern rather than a severe ownership signal.

Repo bus factorcaution

One contributor made all 9 commits in the last 3 months, creating a concentrated maintenance dependency. Organization backing provides some handoff capacity, but no second active contributor is shown.

Repo popularitycaution

The repository has no stars or forks and only one watcher, providing little external validation. Popularity is supporting evidence, so this lowers confidence modestly but does not outweigh the active release and commit history.

Repo toolingcaution

Composer is used as a build tool, which supports reproducible project structure, but no security scanning tools are present. The missing scanning is a transparency gap rather than evidence of unsafe behavior.