7interactive/mpdf

Release historydanger

The package has 62 releases but none in the last 12 months; its latest recorded release was about 3 years 6 months ago. This is strong evidence of stale maintenance for a library dependency.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last 3 months, consistent with the long release gap. The linked project therefore shows no recent maintenance capacity.

Lifecycle scriptscaution

The package runs a post-install command, adding install-time behavior that consumers must account for. No other provided signal shows that this script is unsafe, so this is a limited hygiene concern rather than a severe risk.

Security policycaution

The repository has no security policy, so there is no documented path for reporting vulnerabilities or explaining security handling. This is a modest transparency gap for a mature library.

Workflow auditcaution

All three workflows were analyzed with no dangerous sinks or audit findings, but all 6 action references are unpinned. That leaves avoidable build-integrity risk, though the absence of untrusted checkouts or script injection limits the severity.