setasign/setafpdf

Name lookalikedanger

The package is flagged as borrowing the identity of the much more established setasign/fpdi, despite only 1,422 monthly downloads versus 6,570,404 and no self-described fork indication. This creates a serious risk that consumers intended to select the lookalike package instead.

Repo bus factorcaution

All recent repository commits came from one contributor, giving the project a fragile maintenance base. Organization backing provides some capacity for handoff, so this is a caution rather than a severe abandonment signal.

Repo commit activitycaution

The repository had only 1 commit in the last 3 months, showing limited recent maintenance activity. A recent release and push provide some evidence of ongoing work, but do not offset the very thin activity.

Security policycaution

The linked repository has no security policy, leaving reporting and response expectations undocumented for a library that processes and generates PDFs. No other provided signal compensates for this transparency gap.