devsconexa/mpdf

Lifecycle scriptscaution

The package runs a post-install-cmd script, adding install-time behavior that consumers must trust. No provided signal shows that this script is dangerous, so this is a moderate hygiene concern rather than a severe risk.

Release historycaution

The package has 71 releases over about 2 years, but only one release in the last 12 months. The recent v8.2.6 release provides some evidence of continued publishing, but the overall cadence is now thin.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The same-day release and repository push provide limited compensating evidence, but do not show sustained maintenance.

Repo popularitycaution

The repository has zero stars, zero watchers, and one fork, providing little external evidence of adoption or review. Popularity is supporting evidence only, so this modestly lowers confidence in project maturity rather than determining the verdict.

Workflow auditcaution

All six analyzed action references are unpinned, which weakens build reproducibility and supply-chain hygiene. The audit was complete and found no untrusted checkouts, script injection, or high-severity findings.