atoolo/citycall-bundle

Lifecycle scriptscaution

The package runs a post-install command, adding install-time behavior that consumers should account for. No provided signal shows that the script is unsafe, so this is a limited supply-chain hygiene concern.

Release historycaution

Only two releases were published, with the latest about two years ago and none in the last 12 months. This leaves maintenance and compatibility uncertain despite the package being relatively young.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. The repository is not archived, but this still indicates currently limited visible maintenance.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, which weakens confidence that the linked repository directly documents this package.

Workflow auditcaution

All three analyzed action references are unpinned, so their exact revisions are not fixed. The audit found no dangerous triggers, untrusted checkouts, script injection, or other reported findings, which limits this to a hygiene concern.