wyrihaximus/rector-config

Lifecycle scriptscaution

post-install-cmd and post-update-cmd scripts run during dependency operations, adding supply-chain exposure even though this signal alone does not show harmful behavior.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-maintainer and concentrated-contributor risks are not offset by visible organizational backing.

Release historycaution

The package is only 44 days old and has one release, so its maintenance track record is not yet established.

Repo bus factorcaution

One contributor made all two recent commits, leaving maintenance dependent on a single active person.

Repo commit activitycaution

There were two commits in the last 3 months, so activity is present but still too sparse to demonstrate a mature maintenance cadence.