a21ns1g4ts/filament-shop

Lifecycle scriptscaution

The package runs a post-autoload-dump lifecycle script during Composer installation. This is worth noting because install-time code executes automatically, but the signal alone does not show harmful behavior.

Release historycaution

This is the package's only release, published about 19 months ago, with no releases in the last 12 months. That leaves little evidence of sustained registry maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the single-release history, this raises a meaningful risk of stalled maintenance.

Version stabilitycaution

The assessed version is v0.1.0 and is not marked as a prerelease, but it remains an early major version with only one release, limiting maturity evidence.

Workflow auditcaution

All three workflows were analyzed, but all six action references are unpinned and two workflows grant top-level write permissions. The high-confidence bot-conditions finding in the Dependabot auto-merge workflow is a further workflow-hygiene concern, although no untrusted checkout or script injection was detected.