distantnative/kirby-csv-field

Project backingcaution

The registry namespace and repository are owned by the same individual account, so ownership is consistent, but there is no organizational backing shown to compensate for the thin maintainer base.

Release historycaution

The package has five releases since May 2024, but none in the last 12 months; the latest release was over a year ago. This indicates a meaningful maintenance slowdown, though the release history is established rather than abandoned outright.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap. This raises maintenance and abandonment risk for a dependency.

Repo toolingcaution

The project uses Composer, which matches its PHP package ecosystem. No security scanning tooling was detected, a modest transparency and maintenance gap, but not a severe risk on its own.

Workflow auditcaution

The single workflow was fully analyzed and has no detected untrusted checkout or script-injection paths, but it grants top-level write permissions and all five action references are unpinned. These are workflow hygiene and supply-chain weaknesses without a detected dangerous sink.