backstage/filament-uploadcare-field

Dangerous workflowscaution

One of five workflows uses pull_request_target, specifically an automated Dependabot merge workflow. No untrusted checkouts or script-injection patterns were detected, so the concern is limited rather than severe.

Lifecycle scriptscaution

A post-autoload-dump install script is present. This is a mild supply-chain and installation-behavior concern, although the package's Composer-based structure makes such a script plausible.

Repo commit activitycaution

There were zero commits and zero active maintainers during the last three months. This is a real maintenance warning, though the frequent registry releases and recent repository push provide some counterevidence.

Repo issue activitycaution

There are no open issues and two open pull requests, but no issues or pull requests were merged in the last month. This provides limited evidence of current project activity.

Token permissionscaution

Three workflows declare top-level write permissions and two omit top-level permissions entirely. These broad or unspecified permissions increase workflow-maintenance risk, despite no evidence here of an active exploit.