gheb/docusign-bundle

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts, which can execute code during dependency operations and add supply-chain exposure. No provided signal shows these scripts are unsafe, so this is a moderate hygiene concern rather than a severe risk.

Release historycaution

The package has 51 releases, but its latest registry release was in September 2022 and there were no releases in the last 12 months. This is a substantial maintenance concern for a library with external API integrations.

Repo commit activitycaution

The repository recorded no commits and had no active maintainers in the last three months, reinforcing the long release gap and increasing abandonment risk.

Security policycaution

The linked repository has no security policy, leaving vulnerability reporting and disclosure expectations undocumented. This matters for a package handling electronic-signature integrations.

Workflow auditcaution

The single analyzed workflow is complete and has no detected dangerous triggers, untrusted checkouts, script injection, or audit findings, but all 6 of its action references are unpinned. The missing top-level permissions block is acceptable on its own, while unpinned actions weaken build reproducibility.