remorhaz/ucd

Release historydanger

The package has four releases since April 2020, but none in the last 12 months; the latest release was over two years ago. This is a meaningful maintenance concern for a library tied to Unicode data.

Lifecycle scriptscaution

The package runs both post-install and post-update Composer scripts. These add execution during dependency operations and deserve scrutiny, though the signal does not establish that they are unsafe.

Maintainerscaution

Only one registry maintainer is listed, leaving little visible publishing redundancy. The linked repository is user-owned rather than organization-owned, so there is no provided backing signal to offset that thin base.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the old latest release, this indicates the project may be dormant.

Security policycaution

The linked repository has no security policy. That weakens vulnerability reporting transparency, although the package is not deprecated and the repository remains available.