serendipity_hq/component-geo-builder

Lifecycle scriptscaution

The package defines post-install and post-update Composer scripts. These add install-time behavior that consumers must account for, though the signal gives no evidence that the scripts are unsafe.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-contributor concentration is not offset by visible organizational backing.

Release historycaution

The package has only four releases, all clustered around January 2022, with no registry release in the last 12 months. This is a significant adoption and maintenance concern despite recent source-repository activity.

Repo bus factorcaution

One contributor made 100% of the seven commits in the last three months. That concentration creates a real continuity risk for a user-owned project.

Security policycaution

The repository has no published security policy. This is a transparency gap, though active security scanning provides some compensation.