misterspelik/mpdf

Lifecycle scriptscaution

A post-install-cmd script runs during installation. This is a genuine supply-chain and reproducibility consideration, although the signal does not show that the script is unsafe.

Project backingcaution

The repository is owned by an individual account rather than an organization. This does not prove weak backing, but it provides less visible maintenance capacity than organizational ownership.

Release historycaution

The package has 66 releases and is mature, but it has had no releases in about 20 months. That prolonged release gap lowers confidence in ongoing maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with roughly 20 months since the last push. This is the clearest maintenance concern.

Repo toolingcaution

The project uses Composer, but no security-scanning tools were detected. That is a modest transparency and maintenance gap, not evidence that the package is unsafe.