movingimage/vm6-data-provider-bundle

Release historydanger

The package has had no release in more than nine years: all five releases were published in May 2017, with none in the last 12 months. This is strong evidence of abandonment for a dependency.

Repository archiveddanger

The repository is not formally archived, but it was last pushed in May 2017, matching the stale registry history. That lack of activity offers little practical maintenance assurance.

Licensecaution

The manifest declares a Proprietary license while the repository license file is recognized as BSD-3-Clause. This mismatch needs clarification before adoption, even though a repository license exists.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package, so the source-package relationship is not clearly established. The organization owner is a partial compensating signal, but not enough to remove the concern.

Security policycaution

The repository has no security policy. For an old, unmaintained dependency, the absence of a documented vulnerability-reporting path adds transparency risk.