backstage/uploadcare-field

Dangerous workflowscaution

Six workflows were analyzed with no untrusted checkouts or script injection, but one pull_request_target workflow exists for automated Dependabot merging and deserves review because that trigger can expose elevated repository context.

Lifecycle scriptscaution

A post-autoload-dump install script runs during Composer installation. This is a legitimate but potentially consequential install-time behavior, so it adds a small supply-chain transparency concern.

Repo bus factorcaution

All one recent commit came from a single contributor, leaving no demonstrated contributor redundancy. Organization backing reduces the operational concern somewhat but does not show that a second maintainer is active.

Repo commit activitycaution

Only one commit was recorded in the last three months from one active maintainer, indicating very light recent development despite the strong registry release history.

Repo issue activitycaution

There are no open issues and three open pull requests, but no issues or pull requests were newly created or merged in the last month. This gives little evidence of responsive public collaboration.