cybrix-solutions/easypost

Dangerous workflowscaution

One workflow uses pull_request_target for Dependabot auto-merge. No untrusted checkout or script-injection patterns were detected, but this privileged workflow warrants review.

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is a review point because installation executes package code, although the signal alone does not establish an unsafe dependency.

Repo bus factorcaution

One contributor made all 23 recent commits, creating a strong single-person dependency. The organization-owned repository provides some handoff capacity, but no second active contributor is shown.

Repo issue activitycaution

There are no open issues or pull requests and no recent issue or pull-request activity. This may reflect a quiet project, but it provides no evidence of an active user community or external maintenance.

Repo popularitycaution

The repository has zero stars, forks, and watchers. Popularity is only supporting evidence, but this leaves little external evidence of adoption or community review.