tiderjian/qscmf

Licensecaution

The manifest declares MIT and the artifact contains license files, but detected Apache-2.0 and MIT texts are broader than the declaration. This is a licensing-clarity concern rather than an absence of licensing.

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is common in Composer packages but increases installation behavior that should be understood before adoption.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. This is a meaningful maintenance warning, although the recent registry release provides some counterevidence.

Repo popularitycaution

The repository has 9 stars and 11 forks, indicating a small user and contributor footprint. Popularity is supporting evidence only, but this limits visible community capacity.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool is configured. The missing scan is a transparency and maintenance gap, not evidence of malicious behavior.