osd/l4lhelpers

Licensecaution

The manifest declares MIT, but the artifact license file is recognized as Apache-2.0; although a license file exists, the mismatch creates avoidable legal uncertainty.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single registry maintainer does not have visible organizational backing to offset the inactive project history.

Release historycaution

All 7 releases arrived within roughly 2 days, with no release since January; this shows an immature, currently inactive release track rather than an established maintenance cadence.

Repo commit activitycaution

The repository has 0 commits and 0 active maintainers in the last 3 months, while its last push was in January. That is meaningful evidence of stalled maintenance for a package only months old.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. This is a modest transparency and maintenance gap, not a severe risk by itself.