wikimedia/security-check-plugin

Name lookalikedanger

The package borrows the identity of the much more downloaded wikimedia/composer-merge-plugin, and the detector reports no artifact overlap or README identification as a fork. Consumers may select the wrong package.

Registry deprecationdanger

Packagist marks the entire package as abandoned and explicitly names mediawiki/phan-taint-check-plugin as its replacement. This is a severe adoption and maintenance risk for a new dependency.

Repo bus factorcaution

All 3 recent commits came from one contributor, with a 100% commit share. Wikimedia organization backing provides some handoff capacity, but the observed activity remains concentrated.

Repo commit activitycaution

The repository had only 3 commits in the last 3 months, indicating limited recent development activity despite the package having 4 releases in the last 12 months.

Repo package mentioncaution

The linked repository name does not match the package name and its README does not mention this package, so the package-to-repository relationship is not transparent. Organization backing reduces but does not remove that concern.