fresh-advance/product-feed

Lifecycle scriptscaution

post-install-cmd and post-update-cmd scripts run during Composer operations, adding install-time behavior that deserves review even though lifecycle hooks can be legitimate for this type of module.

Release historycaution

Only one release has been published over 289 days, so there is little evidence of an established release cadence or long-term maintenance.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, which weakens evidence of ongoing development despite the recent repository push timestamp.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear; this is a modest transparency gap for a maintained integration module.

Workflow auditcaution

All three workflows were analyzed without high- or medium-confidence audit findings, and no untrusted checkout or script injection was found. However, all four action references are unpinned, weakening build reproducibility and supply-chain hygiene.