elazaroo/pulse-boosted

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script, which adds execution and review risk beyond a package with no lifecycle automation.

Project backingcaution

The repository is owned by an individual rather than an organization, so continuity depends more directly on the maintainers; the recent multi-contributor activity partly offsets that concern.

Release historycaution

This is the first release, published one day ago, so there is no meaningful history showing sustained maintenance or compatibility over time.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected, leaving a modest gap in ongoing project hygiene.

Workflow auditcaution

The workflow audit completed fully and found read-only permissions with all action references pinned, but it reported six high-confidence unpinned container-image findings in tests.yml. These are CI reproducibility and supply-chain hygiene concerns, not evidence that the release is malicious.