bitexpert/composer-phive-bridge

Release historycaution

This package has had only one release, published over five years ago, with no releases in the last 12 months. That is meaningful evidence of limited maintenance, although the linked repository was pushed more recently.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This supports the concern that maintenance is currently inactive, despite a push in April 2024.

Security policycaution

The linked repository has no security policy. This is a transparency and vulnerability-reporting gap, though it is a smaller concern for this narrowly focused Composer plugin.

Workflow auditcaution

The single workflow was fully analyzed and has no untrusted checkout or script-injection findings, but all three referenced actions are unpinned. That leaves avoidable build-integrity and reproducibility risk.