answear/boxnow-bundle

Lifecycle scriptscaution

The package defines post-install and post-update Composer scripts. These increase installation complexity and execution exposure, though the signal alone does not show harmful behavior.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, which weakens evidence of continuing maintenance despite the recent release.

Repo toolingcaution

Composer build tooling is present, but the repository reports no security scanning tools. This is a meaningful transparency and maintenance gap, not evidence of maliciousness.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and disclosure expectations undocumented.

Workflow auditcaution

Both workflows were analyzed successfully with no dangerous triggers or audit findings, but all six action references are unpinned. Missing top-level permissions blocks are acceptable here because neither workflow uses dangerous triggers or untrusted checkouts.