sagittariusx/beluga.io

Release historydanger

Only two releases were published, with the latest in August 2016 and none in the last 12 months. This is strong evidence that maintenance has stopped, with no newer release activity to offset it.

Licensecaution

The package declares LGPLv3, but the artifact license file and repository license are recognized as MIT. The package is licensed, but the mismatch creates uncertainty about the terms consumers should rely on.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the release history showing no activity since August 2016.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning reduces supply-chain hygiene for a package with otherwise dated maintenance evidence.

Security policycaution

The repository has no security policy, leaving no documented process for reporting or handling vulnerabilities. This is a transparency gap, though it does not by itself show that the package is unsafe.