mytestvendor/my-test-extension

Release historydanger

The package has only two releases, both from July 2022, and none in the last four years. This is strong evidence of abandonment risk, although the repository is not archived.

Lifecycle scriptscaution

The package runs a post-autoload-dump lifecycle script, which adds install-time behavior that consumers should understand. The signal does not show that the script is harmful, so this is a limited supply-chain hygiene concern.

Project backingcaution

The repository is owned by an individual rather than an organization, and no organizational backing is shown. That leaves a relatively thin apparent support base, consistent with the limited release and popularity history.

Repo popularitycaution

The repository has zero stars and forks and only one watcher, indicating little visible adoption or community support. Popularity is supporting evidence, so this modestly reinforces the maintenance concern rather than deciding it alone.

Repo toolingcaution

Composer is used for builds, but no security scanning tools are configured. This reduces transparency around automated security checks, while the absence of scanning alone is not evidence of unsafe code.