bear/aura-router-module

Lifecycle scriptscaution

Composer post-install and post-update scripts run during dependency operations, adding execution complexity for consumers. No accompanying evidence shows these scripts are unsafe, so this is a limited supply-chain hygiene concern.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is a concrete sign of quiet current maintenance, partly offset by the recent package release and repository push.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package. Although the organization backing is consistent, the missing direct identification leaves some uncertainty that this repository is the package's exact source.

Workflow auditcaution

All four workflows were analyzed successfully with no detected findings, dangerous triggers, untrusted checkouts, or script injections. However, all five analyzed action references are unpinned, which weakens build reproducibility and supply-chain control.