danog/php-rtc-dtls

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts, which add execution and maintenance surface during dependency operations even though no concrete harmful behavior is shown here.

Project backingcaution

The registry namespace and repository are owned by the same individual account, so there is no organization-level handoff capacity shown; active commits and a second contributor provide some compensation.

Repo bus factorcaution

Two contributors are active, but the top contributor accounts for about 69% of recent commits, leaving some concentration risk; the second contributor's 31% share partly compensates.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no untrusted checkout, injection, or audit findings; however, all four action references are unpinned, weakening build reproducibility and update safety.