openconext/monitor-bundle

Lifecycle scriptscaution

A post-update-cmd lifecycle script runs during Composer updates. This is a supply-chain consideration, but the signal does not show what the script does or that it is unsafe.

Release historycaution

The package has 19 releases since 2017, but no registry release in the last two years; this reduces confidence in the freshness of the published artifact despite recent repository activity.

Repo bus factorcaution

All recent commits came from one contributor, concentrating maintenance responsibility; organization ownership provides some ability to hand off work but does not remove the current concentration.

Repo commit activitycaution

Only one commit was recorded in the last three months, from one active maintainer, indicating limited recent maintenance momentum even though the repository was recently updated.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and maintenance gap.