erdmannfreunde/optimist-theme-bundle

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts, which increase installation-time behavior and supply-chain exposure compared with a package without lifecycle hooks.

Release historycaution

The package has 17 releases, but none in the last 12 months and the latest release was in October 2024, indicating a prolonged release gap for a package still being assessed.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last 3 months. Its last push was earlier, so this indicates reduced recent maintenance rather than confirmed abandonment.

Security policycaution

The linked repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a transparency gap, partly offset by the available source repository and documentation.

Workflow auditcaution

The single workflow was fully analyzed and has no untrusted checkout or script-injection path, but both action references are unpinned. A high-confidence template-injection finding also weakens workflow hygiene, although it is not independently a severe dependency-health risk.