cable8mm/xeed

Lifecycle scriptscaution

The package uses a post-root-package-install script, adding install-time behavior that deserves attention, though this alone is not a severe concern.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-contributor concentration is not obviously offset by broader project backing.

Repo bus factorcaution

All four recent commits came from one contributor, leaving maintenance dependent on a single active person.

Repo toolingcaution

Composer build tooling is present, but no repository security-scanning tool was detected, leaving a modest transparency and monitoring gap.

Workflow auditcaution

All four workflows were analyzed without reported findings or untrusted checkout/script-injection paths. However, all 11 action references are unpinned and one workflow has top-level write permissions, creating workflow hygiene and update-integrity concerns.