graycore/magento2-graphql-introspection-cache

Lifecycle scriptscaution

Post-install and post-update Composer scripts add execution during dependency operations. Their presence is a supply-chain hygiene concern, although no other provided signal shows workflow exploitation or repository compromise.

Repo bus factorcaution

One contributor made all seven commits in the last three months, creating a real continuity risk. Organization ownership provides some ability to hand maintenance off, so this is caution rather than a severe abandonment signal.

Security policycaution

No security policy was found, leaving vulnerability-reporting expectations unclear for adopters and maintainers.

Version stabilitycaution

Version 0.2.2 is not a stable major release, so compatibility expectations are weaker than for a 1.x package, though it is not marked as a prerelease.

Workflow auditcaution

All three workflows were analyzed with no reported audit findings or untrusted execution paths, and one workflow uses read-only permissions. However, all three action references are unpinned, weakening build reproducibility and action supply-chain protection.