codenzia/project-essentials

Dangerous workflowscaution

One workflow uses pull_request_target for Dependabot auto-merge, which carries elevated automation risk, but no untrusted checkouts or script-injection patterns were detected.

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is a real installation complexity and should be reviewed, although the signal does not show that the script is unsafe.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful maintenance concern, although the recent release cadence partially offsets it.

Repo popularitycaution

The repository has zero stars, forks, and watchers. This is weak supporting evidence for maturity, but popularity alone is not decisive for a young package.

Token permissionscaution

Two workflows lack top-level permissions and two grant top-level write access, leaving CI privileges broader or less explicit than ideal.