oro/google-tag-manager-bundle

Repo bus factorcaution

All recent commits came from one contributor, leaving no demonstrated short-term contributor redundancy. Organization backing provides some handoff capacity, so this is a maintenance caution rather than a severe risk.

Repo commit activitycaution

Only 1 commit from 1 active maintainer was recorded in the last 3 months, indicating limited recent maintenance activity. The package's broader release history shows ongoing releases, which partly offsets but does not remove this concern.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the link may not clearly establish package ownership. This is a transparency concern despite the repository being under the expected organization.

Security policycaution

The repository has no security policy, reducing transparency about how vulnerabilities are reported and handled. This is a hygiene and maintenance gap, not evidence that the package is unsafe.

Version stabilitycaution

The assessed version is 7.0.0 while the signal reports 6.1.4 as the latest version, creating uncertainty about version alignment or repository freshness. The release is marked stable and not prerelease, which is a positive counterpoint.