xqkeji/xq-app-base

Maintainerscaution

Only one registry account has publish access. That is a modest publishing risk, although the linked repository shows the same owner and active recent work.

Repo bus factorcaution

All seven recent commits came from one contributor, leaving no demonstrated handoff capacity if that person stops maintaining the project.

Repo package mentioncaution

The repository name matches the package, which supports the link, but its README does not mention the package name. That weakens confirmation that the repository documentation directly covers this release.

Repo popularitycaution

The repository has zero stars and forks and only one watcher. Popularity is supporting evidence rather than a verdict, but these figures provide little external validation.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected. That is a limited transparency and assurance gap rather than evidence of unsafe code.