byte8/module-vat-validator-hyva

Release historycaution

This package is 143 days old and has only one release, so there is little release history to demonstrate maturity or sustained maintenance.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. For a package only 143 days old, that leaves limited evidence of ongoing maintenance.

Repo toolingcaution

The repository uses Composer build tooling, supporting a conventional package build, but no security scanning tools were detected, leaving a modest transparency gap.

Security policycaution

No repository security policy was found. This is a minor transparency gap for reporting vulnerabilities, not evidence that the package is unsafe.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkout, script injection, or audit findings, but it uses a top-level write token and its one action reference is unpinned. These are workflow hygiene concerns, not severe risks without an untrusted trigger or sink.