solution25/credova

Licensecaution

The artifact contains an MIT license file, but the manifest declares the package as proprietary; that mismatch creates avoidable licensing uncertainty despite the detected license.

Lifecycle scriptscaution

Post-install and post-update scripts run during dependency operations, adding execution surface and requiring more trust than a package without lifecycle hooks.

Repo bus factorcaution

One contributor made all two recent commits, leaving maintenance dependent on a single active individual. Organization ownership provides some handoff capacity but does not remove the concentration.

Repo commit activitycaution

Only two commits were recorded in the last three months. This shows some recent activity, but the volume is limited for a payment integration.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest assurance gap for a payment plugin.