shipstream/magento2-shipstream-sync

Licensecaution

The release includes license files, so it is not unlicensed, but the manifest declares OSL-3.0 while the detected artifact license is MIT. That conflict should be clarified before adoption.

Release historycaution

The package has five releases, but none in the last 12 months and the latest release was about 14 months ago. This indicates a meaningful maintenance slowdown, despite a previously regular median release interval of about 16 days.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the past 3 months, reinforcing the concern that maintenance has gone quiet rather than merely having a slower release cadence.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected. That is a modest hygiene gap rather than a direct dependency risk.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a transparency gap, though not evidence of an unsafe release by itself.