reactphp-x/stream-to-stream

Name lookalikedanger

The package explicitly borrows the identity of the much more established react/stream, with 0.0 artifact overlap but borrows_lookalike_identity=true and no self-described fork. Consumers most likely wanted react/stream, making this a severe supply-chain and adoption risk.

Release historycaution

This is a 499-day-old package with only one release and no releases in the last 12 months. That limited history provides little evidence of sustained maintenance.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months. Combined with the single-release history, this indicates weak recent maintenance activity.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. That leaves a modest verification gap for a package with limited maintenance evidence.

Security policycaution

The linked repository has no security policy. This is a transparency and response-process gap, though it is less serious than the identity and maintenance concerns.