wikimedia/purtle

Name lookalikedanger

The package is reported to borrow the identity of wikimedia/composer-merge-plugin, while artifact overlap is zero and the README does not identify it as a fork or integration. Consumers may have intended the much more popular lookalike package instead.

Release historycaution

The package has 10 releases over more than 10 years, but none in the last 12 months; the latest registry release was nearly two years ago. This weakens confidence in continued maintenance.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. A recent repository push shows the repository is not archived, but does not demonstrate ongoing development.

Security policycaution

The repository has no security policy. This is a transparency gap for reporting vulnerabilities, though it is not by itself evidence of unsafe code.