thunder/thunder-develop

Licensecaution

The artifact includes a license and the repository also has one, so this is not a licensing absence. However, the detected GPL-2.0 text is narrower than the manifest's GPL-2.0-or-later declaration, which creates a clarity concern.

Lifecycle scriptscaution

The package runs post-install, post-update, and pre-update Composer scripts. These are relevant supply-chain and installation-behavior considerations for a development distribution, though the package's scaffolding role makes lifecycle automation plausible.

Release historycaution

The package has had no registry release in about six years, with zero releases in the last 12 months. Recent repository commits partly compensate for the stale release history, but consumers still receive an old published version.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month, despite four open pull requests. This suggests limited visible issue throughput and modestly increases maintenance uncertainty.

Repo toolingcaution

The project uses Composer, but no security scanning tool was detected. For a Composer-based development distribution with install scripts, that leaves a meaningful but moderate transparency and assurance gap.