fond-of-oryx/company-product-list-api

Release historycaution

The package has only 3 releases since June 2022, with none in the last 12 months and the latest released in February 2023. This is a meaningful sign of reduced maintenance, despite the repository having been pushed more recently.

Repo commit activitycaution

There were 0 commits and 0 active maintainers in the last three months. Combined with the stale registry release history, this raises maintenance and abandonment concerns.

Repo toolingcaution

The repository uses Composer and Make, but no security scanning tools were detected. This is a modest transparency and maintenance gap, not a severe risk by itself.

Security policycaution

The repository has no security policy. For a REST API module, this leaves vulnerability-reporting expectations unclear and modestly lowers transparency.

Workflow auditcaution

The workflow audit completed without detected dangerous findings or untrusted triggers, but all 3 action references are unpinned. The missing top-level permissions block is acceptable on its own, so the main concern is reproducibility and action supply-chain hygiene.