atoolo/graphql-search-bundle

Lifecycle scriptscaution

The package defines a post-install command. Install-time code increases dependency-installation exposure, although this signal alone does not show that the script is unsafe.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. That is a meaningful maintenance warning, even though the release history shows the package has been updated over time.

Repo package mentioncaution

The repository name does not exactly match the package name and its README does not mention the package. That may reflect a naming or monorepo relationship, but it still reduces confidence that the linked repository is specifically documented for this package.

Security policycaution

No repository security policy was found. This reduces transparency for reporting and handling vulnerabilities, though it is not by itself evidence that the package is unsafe.

Workflow auditcaution

All five workflows were analyzed with no reported audit findings or untrusted checkout and script-injection sinks. However, all four action references are unpinned, weakening build reproducibility and exposing workflow execution to upstream action changes.