guanguans/soar-php

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts, which add installation complexity and execution surface compared with a package without lifecycle hooks.

Repo commit activitycaution

No commits and no active maintainers were recorded in the last 3 months, which is a maintenance concern, although the same period shows recent releases and merged pull requests elsewhere in the provided evidence.

Workflow auditcaution

All 7 workflows were analyzed with no untrusted checkout or script-injection findings, but all 17 action references are unpinned and a high-confidence bot-condition finding plus an adhoc package installation weaken workflow hygiene.