answear/pay-po

Lifecycle scriptscaution

The package defines post-install and post-update scripts, which add execution during dependency operations. Their presence is a supply-chain hygiene concern, but this signal does not show that the scripts are harmful.

Security policycaution

The repository has no published security policy, reducing transparency about vulnerability reporting and response. This is a moderate process gap, not evidence that the package is unsafe.

Workflow auditcaution

Both workflows were analyzed successfully with no untrusted checkouts, script injection, or audit findings. However, all 6 action references are unpinned, leaving a reproducibility and dependency-integrity hygiene gap.