danog/php-rtc-rtp

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts, which increase installation-time trust requirements even though this signal does not establish harmful behavior.

Project backingcaution

The registry namespace and repository owner match, and the repository is owned by a user rather than an organization; this provides identity consistency but less organizational handoff capacity.

Release historycaution

The package is only 58 days old but has 44 releases, with releases arriving roughly every 80 minutes at the median; this shows active work but also an unusually fast cadence for a dependency.

Repo bus factorcaution

Two contributors are active, and the second contributor made 29 commits, partly offsetting the leading contributor's 69% share; the small contributor base still leaves some continuity risk.

Workflow auditcaution

The only workflow was fully analyzed, uses read-only permissions, and has no untrusted checkouts or script injection findings. However, all 3 action references are unpinned, leaving avoidable action-supply-chain exposure.