popphp/framework

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. Such scripts can be legitimate for framework setup, but they add installation behavior that deserves attention when accepting the dependency.

Release historycaution

The package is young at 31 days but has 11 releases in that period, showing active publication rather than abandonment. Its short history leaves limited evidence of long-term stability.

Repo bus factorcaution

One contributor made all 27 commits in the last three months, leaving maintenance highly concentrated. Organization backing provides some handoff capacity, but no second active contributor is shown.

Repo toolingcaution

Composer is used as the build tool, but no security-scanning tooling was detected, leaving automated security coverage unshown.

Security policycaution

The repository has no security policy, so the project gives consumers no documented security-reporting process.