xqkeji/xq-app-attach

Release historycaution

The package has eight releases over about three and a half years, with two releases in the last 12 months; the roughly eight-and-a-half-month median interval indicates a slow but not abandoned cadence. The release on the assessment date is compensating evidence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although the current release and push are recent, the lack of ongoing development evidence raises maintenance risk.

Repo popularitycaution

The repository has no stars or forks and only one watcher, so there is little external adoption evidence. Popularity is supporting evidence only, and the matching repository and recent release partly offset this weakness.

Repo toolingcaution

Composer is used as a build tool, which is appropriate for this package. No security scanning tools are configured, leaving a modest review gap rather than a severe dependency risk.

Security policycaution

The repository has no security policy, so there is no documented channel or process for reporting vulnerabilities. This is a transparency and response-readiness gap, but not evidence of unsafe code by itself.