codexpertio/plugin-tracker-sdk

Release historycaution

The package is only 31 days old with three releases, so its long-term maintenance record is not established. The roughly 13-hour median interval reflects an active initial release sequence rather than abandonment.

Repo bus factorcaution

One contributor made 100% of the 56 recent commits, creating a significant continuity risk. Organization backing provides some capacity for handoff, but no second active contributor is observed.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected in the repository.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

The release workflow uses a top-level write token and its only action reference is unpinned; the audit also reports two high-confidence template-injection findings. No untrusted checkout or script-injection trigger was found, so these are workflow hygiene concerns rather than a standalone severe risk.