becklyn/icon-loader

Release historycaution

The latest release was published over four years ago, with no releases in the last 12 months. Earlier releases were regular, but the prolonged pause raises maintenance and abandonment concerns.

Repo popularitycaution

The repository has only 1 star and 1 fork, indicating limited external adoption. This is supporting caution rather than a major concern for a small, focused package.

Repo toolingcaution

Composer is used as the build tool, but no security-scanning tooling is reported. The missing scanning automation is a modest transparency gap, not evidence of unsafe code.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations unclear.

Workflow auditcaution

The single workflow was fully audited with no dangerous findings or untrusted checkouts, but both analyzed action references are unpinned. The workflow lacks a top-level permissions block, which is acceptable on its own.