abdallahalyamni/mpdf-arabic

Lifecycle scriptscaution

A post-install command runs during installation, increasing the amount of package behavior executed in a consumer environment. The signal does not show malicious behavior, but it is an avoidable supply-chain consideration.

Release historycaution

This package has only one release, published over three years ago, with no releases in the last 12 months. That gives little evidence of ongoing release maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although it was pushed more recently than the package release, current maintenance activity is not demonstrated.

Workflow auditcaution

All six analyzed action references are unpinned, so workflow builds can resolve changing action code over time. The audit found no untrusted checkouts, script injection, excessive top-level write permissions, or other reported findings.