bear/api-doc

Lifecycle scriptscaution

The package defines post-install and post-update Composer scripts. These add installation-time behavior that consumers must account for, although the signal alone does not show that the scripts are unsafe.

Maintainerscaution

Only one registry account has publishing access. The repository is organization-owned, which provides some backing, but publishing continuity still depends on a narrow registry maintainer base.

Repo bus factorcaution

All 46 recent commits came from one contributor. Organization ownership partly mitigates handoff risk, but no second active contributor is shown, so continuity remains a concern.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. The missing scanner is a hygiene gap rather than evidence of abandonment.

Workflow auditcaution

All six workflows were analyzed, but all 19 action references are unpinned, one workflow has top-level write permissions, and high-confidence template-injection findings plus ad hoc package installs were reported. No pull_request_target, workflow_run, untrusted checkout, or script-injection path was found, so this is workflow hygiene and supply-chain exposure rather than a severe standalone risk.