atoolo/events-calendar-bundle

Lifecycle scriptscaution

A post-install command runs during installation, which adds execution-time behavior and some supply-chain exposure compared with a package without lifecycle scripts.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, a meaningful recent slowdown that raises maintenance risk even though the repository was pushed recently.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the linkage is not clearly demonstrated and could reflect repository piggy-backing.

Security policycaution

No security policy is present, leaving vulnerability reporting and response expectations undocumented; this is a transparency gap, not evidence of an unsafe release.

Workflow auditcaution

All four workflows were analyzed without high-confidence findings or untrusted-trigger sinks, but all three action references are unpinned, reducing build reproducibility and action-integrity assurance.