rarst/locate-vendor

Release historydanger

The package has only two releases, both dating from 2014, with no release in roughly 12 years. This is strong evidence of abandonment risk, although the package's small scope may reduce the need for frequent changes.

Repo commit activitydanger

There were zero commits and zero active maintainers in the last three months, consistent with no observed activity since 2014. This materially increases abandonment and compatibility risk.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single registry maintainer is consistent with the available project backing. This provides limited maintenance redundancy.

Repo popularitycaution

The repository has five stars and no forks, indicating limited adoption and external validation. Popularity is supporting evidence rather than decisive, but it provides little compensating confidence for the maintenance gap.

Repo toolingcaution

The repository uses Composer but has no detected security-scanning tools. Composer is appropriate for the package; the missing scanning is a minor transparency gap rather than a severe concern.