mohdh/blog

Release historydanger

The package has only two releases, both published in March 2023, with no releases in the last 12 months. This strongly raises abandonment risk for a dependency with no newer maintenance evidence.

Licensecaution

The artifact contains an MIT license file, but the manifest declares the package proprietary. This mismatch creates licensing ambiguity despite the presence of a recognized license file.

Lifecycle scriptscaution

A post-autoload-dump Composer lifecycle script runs during installation, adding install-time behavior that consumers must account for. No other provided signal demonstrates why this hook is necessary or harmless.