xia/migration

Licensecaution

The manifest declares Apache-2.0, while the artifact license file is recognised as MIT. The artifact is licensed, but the mismatch creates legal and transparency uncertainty.

Project backingcaution

The repository is owned by an individual account rather than an organization, so there is no demonstrated organizational backing to compensate for the thin maintenance record.

Release historycaution

The package has existed for about 5 years but has only 7 releases and none in the last 12 months; the latest release was about 18 months ago, which raises maintenance concerns.

Repo commit activitycaution

The repository had no commits and no active maintainers in the last 3 months, reinforcing the concern raised by the absence of releases in the last year.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the source-to-package relationship is unclear rather than transparently established.