wazum/composer-fanfare

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-maintainer concentration is not offset by visible organizational backing.

Release historycaution

The package is only 133 days old, with four releases clustered over roughly three days. That shows early activity but provides limited evidence of long-term maintenance.

Repo bus factorcaution

All six recent commits came from one contributor, leaving maintenance dependent on a single person without demonstrated handoff capacity.

Workflow auditcaution

The workflow audit completed cleanly with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all eight action references are unpinned, leaving the build exposed to upstream action changes.