answear/econt-pickup-point-bundle

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts, which add install-time behavior and therefore require review before adoption, although no dangerous behavior is shown here.

Repo commit activitycaution

No commits and no active maintainers were observed in the last 3 months. This is a maintenance concern, although the same period includes a newly published release and a merged pull request.

Repo toolingcaution

Composer build tooling is used, but no security scanning tools were detected, leaving a security-maintenance gap.

Security policycaution

The repository has no security policy, reducing transparency about vulnerability reporting and response expectations.

Token permissionscaution

Neither workflow declares top-level token permissions. No workflow requests top-level write access, but explicit least-privilege settings would provide stronger CI hygiene.