wikimedia/scoped-callback

Name lookalikedanger

The signal marks the package as borrowing the identity of wikimedia/aho-corasick, with borrows_lookalike_identity true. Although artifact overlap is zero and the README does not identify that package, this naming evidence creates a serious risk that consumers may select the wrong dependency.

Release historycaution

The package has five releases since 2016 but none in the last 12 months, with a median release interval of about 715 days. The linked repository was pushed recently, but registry release activity remains sparse.

Repo commit activitycaution

There were no commits and no active maintainers in the three months measured. This is a meaningful maintenance concern, although the repository's recent push indicates it is not abandoned outright.

Repo toolingcaution

The repository uses Composer for builds, but no security scanning tool was detected. The missing scanning is a transparency gap, though the project is a small PHP library.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations undocumented.