dniccum/linear-sdk

Lifecycle scriptscaution

The package runs a post-autoload-dump Composer script during installation. This is a limited lifecycle hook, but it still adds install-time behavior that consumers should account for.

Release historycaution

The package was first released today and has only 3 releases, all within the same day. This provides too little history to demonstrate sustained maintenance.

Repo commit activitycaution

The repository shows 0 commits and 0 active maintainers in the last 3 months, although the project is newly released and has 6 merged pull requests in the last month. The short history limits confidence rather than proving abandonment.

Security policycaution

No repository security policy was found. This is a transparency gap for a package handling OAuth credentials and API keys, though it is not evidence of a defect by itself.

Workflow auditcaution

All 18 referenced actions are unpinned, and one high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The repository also has write permissions in 3 workflows; no untrusted checkout or script injection was detected, so this is a hygiene concern rather than a severe risk.