bambamboole/extended-testbench

Lifecycle scriptscaution

The package runs post-autoload-dump, post-install-cmd, and post-update-cmd scripts, which increases install-time execution exposure even though such scripts can be normal for Composer packages.

Release historycaution

Seven releases were published within the package's first 49 days, including this release, showing active early iteration. The short history limits evidence of long-term maintenance.

Repo bus factorcaution

One contributor made about 88% of the recent commits, but a second contributor remains active. This is a genuine continuity concern for a user-owned project, not an abandonment signal by itself.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a transparency gap rather than evidence of unsafe code.

Workflow auditcaution

The only workflow was fully analyzed with no audit findings or untrusted-code sinks, but all three referenced actions are unpinned. That weakens build reproducibility and supply-chain hygiene without making the workflow dangerous on its own.