ahmedkhd/sylius-bot-plugin

Release historydanger

The latest release was published in May 2023, with no releases in the following 12 months of the observed history. That is a prolonged maintenance gap for a package used as an application plugin.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the release history's prolonged inactivity.

Lifecycle scriptscaution

The package runs post-create, post-install, and post-update Composer scripts. These increase installation complexity and the amount of package code executed during dependency operations.

Security policycaution

The repository has no security policy, leaving no stated process for reporting or handling vulnerabilities. This is a transparency and maintenance gap, though it does not by itself show the package is unsafe.

Workflow auditcaution

All 7 analyzed workflow action references are unpinned, which weakens build reproducibility. The reported cache-poisoning findings have low confidence and therefore add little weight; the audit otherwise completed and found no untrusted checkout or script-injection path.