therour/db-migrator

Lifecycle scriptscaution

A post-root-package-install script runs during installation. Install hooks add execution and maintenance surface, though this alone is not evidence that the package is unsafe.

Release historycaution

The package has had no releases in more than six years, with only four releases overall and none in the last 12 months. This is substantial abandonment risk despite the package not being deprecated.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, while the repository was last pushed more than five years ago. This strongly reinforces the release-history concern.

Repo toolingcaution

Composer is used for builds, but no security scanning tools are present. That is a transparency and maintenance gap, not a severe risk by itself.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This modestly reduces transparency for a package used in database tooling.