danog/php-rtc-webrtc

Lifecycle scriptscaution

post-install-cmd and post-update-cmd scripts execute package-defined behavior during dependency operations, creating a modest supply-chain and reproducibility concern.

Project backingcaution

The package and repository are owned by the same individual account, so the source linkage is clear, but there is no organization-level backing shown.

Repo bus factorcaution

Two contributors are active, but the leading contributor made about 68% of recent commits, leaving some concentration risk despite the second contributor's substantial activity.

Workflow auditcaution

The sole workflow was fully analyzed, uses read-only permissions, and has no untrusted checkout, injection, or audit findings. However, all four action references are unpinned, reducing build reproducibility and action-integrity assurance.