theme-ultimate/installer-theme-ultimate

Dependency profilecaution

The installer declares three runtime dependencies, including a private repository-license package and the Theme Ultimate package itself. That is coherent for an installer, but the private licensing dependency creates an adoption prerequisite and increases dependency-chain complexity.

Licensecaution

The manifest declares a proprietary license, and no license file is included in the package or repository. This is explicit licensing rather than an unlicensed release, but it limits transparency and reuse for an open-source dependency.

Package file treecaution

The artifact and repository each contain only README.md and composer.json, consistent with the stated installer-stub role. This keeps the package easy to inspect but provides little implementation evidence of its own.

Repo bus factorcaution

One contributor made 21 of 22 recent commits, or about 95%, while a second contributor made one. Because the repository owner is recorded as a user rather than an organization, this concentration is a meaningful maintenance risk.

Repo package mentioncaution

The repository name does not match the package name, and its README does not mention this package. That raises a concrete concern that the package may be associated with the wrong or unrelated source repository.