datomatic/db-opening-hours

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This adds execution during installation, but the signal does not show a dangerous command or an unusual number of scripts.

Repo bus factorcaution

All eight recent commits came from one contributor, so maintenance continuity depends heavily on a single person. Organization ownership provides some handoff capacity but does not eliminate the concentration risk.

Repo popularitycaution

The repository has one star and no forks, so there is little independent adoption evidence. Popularity is supporting evidence only and does not outweigh the active repository signals.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations unclear for consumers.

Workflow auditcaution

All 13 action references are unpinned, and four workflows grant top-level write access. The audit also reports high-confidence bot-condition and template-injection findings, but no untrusted checkout or script-injection sink was found, so these are workflow-hygiene concerns rather than a severe standalone risk.