freema/react-admin-api-bundle

Project backingcaution

The registry namespace and repository owner match, but both are owned by a single user rather than an organization. This offers direct ownership consistency but limited evidence of institutional backing.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. Although the latest release shows recent work, the current inactivity raises a real risk that maintenance has slowed or stopped.

Repo popularitycaution

The repository has zero stars, one fork, and one watcher. Popularity is only supporting evidence, but these very small numbers provide little evidence of broad community review or shared maintenance.

Repo toolingcaution

The project uses Composer and Task for builds and has no detected security-scanning tools. The missing scanning is a modest hygiene gap, not evidence that the package is unsafe.

Workflow auditcaution

Both workflows were fully analyzed with no audit findings or untrusted checkouts, but all 13 action references are unpinned and one workflow grants top-level write access. This is a meaningful reproducibility and workflow-hygiene concern, though no dangerous trigger or sink was found.