sogekingbr/composer

Release historydanger

The package has had no release in about 4 years and 6 months, with all three releases clustered on March 13, 2022. This is strong evidence of abandonment for a dependency.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last 3 months, consistent with the long release hiatus. No provided maintenance signal compensates for this inactivity.

Licensecaution

The manifest declares a proprietary license, and no license file was detected in the artifact or repository. The release is therefore licensed as declared, but it is not clearly available under an open-source license for ordinary dependency use.

Lifecycle scriptscaution

The package defines a post-update-cmd lifecycle script, which adds execution during dependency updates and deserves review. The signal does not show that the script is malicious or unusually broad, so this is a moderate hygiene concern.

Maintainerscaution

Only one registry account has publishing access, and project_backing identifies a user-owned repository rather than an organization. This leaves limited visible publishing continuity, although registry access alone is not proof of maintenance.