wikimedia/relpath

Name lookalikedanger

The package is reported to borrow the identity of wikimedia/less.php, with 16,004 versus 995,875 monthly downloads and borrows_lookalike_identity=true. Although artifact overlap is 0 and the README does not identify it as the lookalike, the explicit identity-borrowing evidence is a severe supply-chain concern.

Repo bus factorcaution

All one recent commit came from a single contributor. Wikimedia organization backing partly compensates for this concentration, but the observed recent activity remains narrow.

Repo commit activitycaution

The repository recorded one commit in the last three months. This shows some recent activity but is thin evidence of sustained maintenance.

Security policycaution

The repository has no security policy. For a small path utility this is a transparency gap rather than evidence of abandonment, but it leaves vulnerability-reporting expectations unclear.