mpietrucha/support

Lifecycle scriptscaution

The package defines a post-update-cmd lifecycle script, adding install or update behavior beyond ordinary file installation. This is a modest transparency and supply-chain concern, not a severe risk by itself.

Maintainerscaution

Only one registry account has publish access. Because registry access lists are administrative rather than activity evidence, this is a limited concern and is reinforced mainly by the repository's contributor concentration.

Package scaffoldingcaution

The package has no readme, which matters for a reusable PHP library that consumers must integrate against. Missing tests and a changelog are normal packaging practice here and are not counted as gaps.

Project backingcaution

The repository is owned by an individual rather than an organization, and the activity data shows one active contributor. This provides no visible institutional maintenance cushion.

Repo bus factorcaution

All 37 commits in the last three months came from one contributor, giving the project a complete single-person bus factor. No organizational backing is shown to provide an obvious handoff path.