beholdr/filament-trilist

Lifecycle scriptscaution

A post-autoload-dump install-time script runs during Composer installation. This is a mild operational consideration, but the signal alone does not show harmful or unusually broad behavior.

Project backingcaution

The registry namespace and repository owner match, but the owner is an individual account rather than an organization. This indicates direct ownership without the stronger continuity signal of organizational backing.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is a meaningful maintenance warning, though recent registry release activity provides some contrary evidence.

Repo toolingcaution

The repository uses Task and Composer build tooling, but no security-scanning tools were detected. The missing scanner is a hygiene gap rather than evidence that the package is unsafe.

Workflow auditcaution

Both workflows were fully analyzed with no audit findings, no untrusted checkouts, and no script injection. However, all five action references are unpinned, which weakens build reproducibility and leaves dependency updates uncontrolled.