basecom/sw6-fixtures-plugin

Licensecaution

Although the manifest declares a proprietary license, the artifact and repository both contain a recognized MIT license file. The license-file evidence compensates for the conflicting manifest declaration, but consumers should clarify the metadata mismatch.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. That is a meaningful maintenance warning, although the recent release and August push provide some counterevidence.

Security policycaution

The repository has no security policy. This is a transparency and vulnerability-reporting gap for a package intended to run inside Shopware projects.

Workflow auditcaution

Both workflows were fully analyzed with no detected sinks or high-confidence audit findings. However, all 13 action references are unpinned and one workflow grants top-level write access, creating avoidable workflow supply-chain and permissions risk.