wexample/symfony-loader-demo

Lifecycle scriptscaution

The package declares post-install and post-update Composer scripts. These add install-time behavior that consumers should understand, although the signal alone does not establish a severe risk.

Release historycaution

The package is only 9 days old but already has 55 releases, with a median interval of 0 days. That shows active publishing, but the unusually compressed history provides little evidence of long-term stability.

Repo bus factorcaution

One contributor made 74 of 77 recent commits, creating a high concentration risk. The second active contributor and organization ownership partly compensate, so this remains a caution rather than a severe abandonment signal.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. For a development-only fixture this is a transparency gap, not evidence of unsafe code.

Security policycaution

The linked repository has no security policy. That weakens vulnerability-reporting transparency, though the package's README identifies it as a development fixture rather than an application runtime dependency.