atendwa/msingi

Workflow auditdanger

The audit found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow, and all 12 analyzed action references are unpinned. Three workflows also grant top-level write permissions, increasing workflow supply-chain and automation risk.

Dependency profilecaution

Seventeen runtime dependencies make this package materially dependent on a broad framework and plugin stack, increasing maintenance and compatibility exposure.

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is common in Composer packages but adds installation behavior that dependents should account for.

Project backingcaution

The package and repository are owned by the same individual account. This is coherent ownership, but it does not provide organizational backing or redundancy.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful sign of slowed maintenance despite the earlier release history.