phprise/dto-contract

Lifecycle scriptscaution

A post-create-project-cmd install-time script is present, adding execution during project creation and warranting caution even though no malicious conclusion follows from this signal.

Release historycaution

The package is 109 days old and has only one release, leaving little evidence of sustained maintenance or release discipline.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. For a package this young, that leaves future maintenance capacity unproven rather than demonstrating abandonment.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected, leaving a modest repository hygiene gap.

Workflow auditcaution

No GitHub Actions workflows were present, so no workflow-specific trigger, permission, or action-pinning risk was found; this also means there is no observed CI automation to support ongoing validation.