pecl/xattr

Release historycaution

The package has only one release, published 370 days ago, with no releases in the last 12 months; this limits evidence of ongoing release maintenance.

Repo bus factorcaution

One contributor made all two recent commits, creating a concentrated maintenance dependency; PHP organization backing provides some capacity to hand off ownership but does not remove the concern.

Repo commit activitycaution

The repository recorded two commits in the last three months, showing some activity, but the volume is modest for a package with otherwise sparse release history.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, so the package-to-source relationship is less transparent; the organization-owned repository reduces but does not eliminate this concern.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected; this is a modest transparency and maintenance gap rather than a severe risk.