taoser/think-addons

Lifecycle scriptscaution

The package runs a post-install command, adding install-time behavior that consumers should understand before adoption.

Maintainerscaution

Only one registry account has publish access. This is a narrow publishing base, although the repository shows that the same maintainer is actively committing.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-maintainer concentration is not offset by visible organizational backing.

Repo bus factorcaution

One contributor made all 12 commits in the last 3 months, leaving the project dependent on a single maintainer and increasing continuity risk.

Repo toolingcaution

Composer is used for builds, but no security-scanning tool is configured, leaving a preventable security-process gap.