ethicks/filtcms

Workflow auditdanger

All five workflows were analyzed, but all 12 action references are unpinned, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. Three workflows also grant top-level write permissions; although no untrusted checkout or script injection was found, this weakens automation integrity.

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This adds execution during installation and warrants some caution, although the signal does not show that the script is harmful.

Maintainerscaution

Only one account has registry publish access. Because the repository is user-owned rather than organization-owned, this indicates a thin visible publishing and maintenance base.

Project backingcaution

The source repository is owned by an individual user, not an organization, so there is no observed organizational backing to offset the single registry maintainer and recent inactivity.

Release historycaution

The package is about 309 days old and has 10 releases, but all 10 occurred within the last 12 months with a very short median interval, indicating a concentrated early release burst rather than a demonstrated long-term cadence.