antecedent/patchwork

Project backingcaution

The registry namespace and repository are owned by the same individual account, so there is no organization-level handoff capacity shown. Recent activity from two contributors partly offsets that limitation.

Security policycaution

The repository has no security policy file. This is a transparency gap for a package that performs PHP code and callable redefinition, though active maintenance and dependency scanning provide some compensation.

Workflow auditcaution

All three workflows were analyzed successfully, use read-only permissions, and pin all 13 action references. The audit still found a floating container image and a high-confidence template-injection pattern, which are workflow hygiene concerns but lack the untrusted trigger or sink evidence needed to treat them as severe supply-chain risks.