answear/inpost-pickup-point-bundle

Lifecycle scriptscaution

The package uses post-install and post-update Composer scripts. These add installation complexity and warrant caution even though no separate evidence shows harmful behavior.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months. This is a meaningful maintenance warning, although the recent release shows that the project has not been abandoned outright.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. That reduces automated assurance around dependency and repository security hygiene.

Security policycaution

The repository has no security policy. This weakens transparency about vulnerability reporting and response expectations.

Workflow auditcaution

Both workflows were fully analyzed with no high-confidence audit findings or dangerous triggers, but all six action references are unpinned. Missing top-level permissions blocks are acceptable here because no workflow has top-level write access, while unpinned actions remain a supply-chain hygiene gap.