wyrihaximus/ticking-promise

Lifecycle scriptscaution

post-install-cmd and post-update-cmd scripts run during dependency installation or updates, increasing the amount of package code that executes automatically.

Maintainerscaution

Only one account has registry publish access, leaving a thin publishing base. The repository is user-owned rather than organization-backed, so no compensating organizational backing is shown.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is a meaningful maintenance warning, though the recent release and merged pull requests provide some counter-evidence.

Repo toolingcaution

The repository uses Composer and Make, but no security-scanning tooling was detected. The missing scanner is a hygiene gap rather than evidence of abandonment.

Security policycaution

No security policy is present in the repository, reducing transparency about how vulnerabilities should be reported and handled.