flagbit/oxid-smart-inbox-connector

Release historydanger

The package has only one release, published in April 2021, with no releases in the following five years. This strongly limits evidence of ongoing maintenance, though the stable 1.0.0 version reduces pre-release risk.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap. This is a meaningful abandonment concern for a dependency.

Lifecycle scriptscaution

Post-install and post-update scripts run during dependency operations, creating additional execution and maintenance surface. No provided signal compensates for that extra lifecycle complexity.

Security policycaution

The linked repository has no security policy, leaving vulnerability-reporting expectations unclear. This is a transparency gap, although it is less severe than the prolonged inactivity.

Workflow auditcaution

Both workflows were analyzed without dangerous triggers or audit findings, but all six action references are unpinned. The workflows also lack top-level permissions blocks, which is acceptable on its own; unpinned actions remain a supply-chain hygiene gap.