mercadopago

Lifecycle scriptscaution

The package has a prepare install-time lifecycle script. Its presence adds some supply-chain and installation complexity, although no dangerous behavior is evidenced by this signal alone.

Security policycaution

The repository has no SECURITY.md or other detected security policy, leaving vulnerability-reporting and response expectations less transparent.

Token permissionscaution

Both workflows lack top-level permissions declarations, and neither has read-only permissions explicitly declared. No workflow has top-level write permissions, but explicit least-privilege configuration would be preferable.