wikimedia/object-factory

Name lookalikedanger

The signal reports that the package borrows the identity of the more downloaded wikimedia/utfnormal, with 50% artifact overlap and no self-described fork; consumers may select the wrong package and should verify the intended dependency.

Repo bus factorcaution

All recent commits came from a single contributor, creating a concentrated maintenance dependency; Wikimedia organizational backing partly compensates for this risk.

Repo commit activitycaution

There was one commit in the last 3 months from one active maintainer, which shows some recent activity but only limited maintenance capacity.

Repo toolingcaution

The repository uses Composer for builds, but no security scanning tooling was detected; this is a transparency gap rather than evidence of unsafe code.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations undocumented.