grizzlyware/model-swapper

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script, which adds execution during installation and modestly increases dependency trust requirements.

Release historycaution

The package has only three releases and none in the last 12 months; the latest registry release was over two years ago, indicating weak current maintenance momentum.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, a meaningful sign of currently limited development activity.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations and response contacts less transparent.

Workflow auditcaution

All eight action references are unpinned, and the audit found high-confidence bot-condition and unpinned-container-image issues. A pull_request_target workflow also has top-level write permissions, but no untrusted checkout or script-injection sink was reported, so this is caution rather than a severe finding.