cpsit/cps-myra-cloud

Registry deprecationdanger

Packagist marks the entire package as abandoned and names cpsit/myra-cloud-connector as its replacement, making this release a poor long-term dependency choice despite recent activity.

Repo bus factorcaution

All 11 recent commits came from one contributor, so maintenance is vulnerable to that person's unavailability; organization backing provides some handoff capacity but does not remove the concentration.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, creating uncertainty about the package-to-source relationship even though the repository is organization-owned.

Security policycaution

The repository has no security policy, which is a transparency gap for reporting and handling vulnerabilities, though active maintenance and security scanning provide limited compensation.

Workflow auditcaution

All workflows were analyzed, all 15 action references are pinned, and no untrusted checkout or script-injection trigger was found. High-confidence template-injection findings in the release workflow are still a workflow hygiene concern; the low-confidence cache-poisoning finding carries little weight without corroboration.