evotodi/composer-downloads-plugin

Release historycaution

The latest release was about five years ago, with no releases in the last 12 months. That long gap is a meaningful maintenance concern for a dependency.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, consistent with the package's prolonged release gap and increasing abandonment risk.

Repo popularitycaution

The repository has zero stars, forks, and watchers. Popularity is only supporting evidence, but it provides no additional sign of community adoption or review.

Security policycaution

The repository has no security policy. This is a transparency gap, although the package's other documentation and source files provide some compensating context.

Workflow auditcaution

All three analyzed action references are unpinned, which weakens build reproducibility. The workflow has no untrusted checkout, script injection, or broad top-level write permission findings, so this remains a hygiene concern.