bounteous-inc/composer-darn

Release historycaution

The package is only 31 days old and has one release, so there is little evidence of long-term maintenance or release maturity.

Repo bus factorcaution

All recent commits came from one contributor. Organization ownership provides some handoff capacity, but current observed maintenance remains concentrated.

Repo commit activitycaution

There was one commit in the last three months, so recent activity exists but is too sparse to demonstrate an established maintenance cadence.

Repo toolingcaution

The repository uses Composer build tooling, but no security scanning tool was detected. The missing scanner is a modest transparency gap rather than evidence of abandonment.

Workflow auditcaution

All two workflows were analyzed, but all seven action references are unpinned. The release workflow also has a high-confidence finding that its GitHub App token inherits blanket installation permissions, creating a meaningful release-pipeline hygiene risk.