friendsofhyperf/async-task

Dangerous workflowscaution

One of two workflows uses pull_request_target, which can increase CI supply-chain exposure when handling untrusted pull requests. No untrusted checkout or script-injection patterns were detected, limiting the concern.

Package scaffoldingcaution

A consumer-facing README is present and the release has a GitHub release marker. Missing tests and changelog files in the published artifact are normal packaging practice, while the repository's lack of tests and changelog is a modest project-hygiene gap.

Release historycaution

The package has 34 releases since October 2022, but its latest release was in December 2023 and there have been no releases in the last 12 months. This indicates a materially stale release cadence despite earlier activity.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long gap since the latest release. The non-archived status provides some reassurance but does not offset the current inactivity.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a transparency and maintenance gap, though it is not by itself evidence that the package is unsafe.