binarybuilds/filament-cache-manager

Workflow auditdanger

All five workflows were analyzed, but all 12 action references are unpinned, three workflows grant top-level write permissions, and a high-confidence bot-conditions finding may allow actor-context spoofing. The pull_request_target workflow has no untrusted checkout or script-injection findings, which limits the severity but does not remove the hygiene risk.

Lifecycle scriptscaution

The package uses a post-autoload-dump lifecycle script. This adds install-time behavior that deserves review, but the signal alone does not show harmful or unusually broad actions.

Release historycaution

This is the only release after about 11 months of package age, so there is little evidence of an established release track record.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. Although the repository was pushed recently and had three merged pull requests in the last month, the recent commit window provides weak ongoing-maintenance evidence.