neos/tiga

Release historydanger

This is the only release, published about 10 years ago, with no releases in the last 12 months. That strongly indicates abandonment rather than an actively maintained dependency.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap and leaving current maintenance uncertain.

Lifecycle scriptscaution

The package defines post-create, post-install, and post-update Composer scripts, so installation and updates execute package-controlled actions. This increases dependency risk, especially for an old experimental project.

Package file treecaution

The published tree includes private.key, certificate files, and other cryptographic key material alongside application code. Even without treating this as proof of maliciousness, shipping such material is a serious packaging and operational concern.

Repo toolingcaution

Composer is used for builds, but no security-scanning tooling is present. That leaves an established maintenance and transparency gap, although it is not evidence that the package is malicious.