datlechin/flarum-cbox

Licensecaution

The artifact contains a license file, but the manifest declares Unlicense while the file is detected as MIT. The release is licensed, yet the mismatch creates avoidable legal ambiguity.

Release historycaution

Only two releases were published, both within four days in August 2024, with no releases in the following 12 months. This is a meaningful maintenance concern for a dependency.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the measured three-month period. Although it is not archived, the observed activity does not demonstrate ongoing maintenance.

Workflow auditcaution

Both workflows were analyzed without high- or medium-severity findings, and no untrusted checkout or script injection was found. However, both of the two action references are unpinned, leaving a modest supply-chain hygiene gap.