anodyne/blade-hugeicons

Repo bus factorcaution

All 21 recent commits came from one contributor, so maintenance depends heavily on a single person. Organization backing partly offsets the handoff risk but does not remove it.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. For a small PHP package this is a modest hygiene gap rather than a severe dependency risk.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear. This lowers transparency but does not by itself indicate abandonment.

Workflow auditcaution

All four analyzed action references are unpinned, which weakens build reproducibility; however, the workflow uses read-only permissions, has no untrusted checkouts or injection findings, and the audit completed fully.