parcelvalue/api

Lifecycle scriptscaution

post-install-cmd and post-update-cmd scripts run during dependency operations. Their presence adds some supply-chain and installation complexity, although no malicious behavior is established by this signal.

Repo bus factorcaution

All 3 recent commits came from one contributor, leaving maintenance dependent on a single active contributor and creating a genuine continuity risk.

Repo toolingcaution

Composer is used for builds, but no security scanning tools were detected, leaving repository security hygiene less independently verified.

Security policycaution

The repository has no security policy, which makes vulnerability reporting and coordinated response less transparent.