haitham-maznai/form-stepper

Lifecycle scriptscaution

A post-autoload-dump install script is present. This is a mild supply-chain consideration, but the provided signal gives no evidence that the script is unsafe or unusually broad.

Maintainerscaution

Only one registry publishing maintainer is listed, which is a modest continuity concern for a user-owned project. Repository activity shows broader recent participation, reducing the practical bus-factor concern.

Project backingcaution

The package is backed by a user-owned repository rather than an organization, so the single registry maintainer provides less formal continuity than organizational backing. Recent multi-contributor activity is reassuring.

Release historycaution

The package is 0 days old with only 2 releases, so its release process and long-term maintenance record are unproven. Recent repository activity partly offsets this maturity gap.

Workflow auditcaution

Both workflows were analyzed successfully, all 5 action references are pinned, and no audit findings or untrusted checkout or script-injection paths were detected. One workflow grants top-level write permission, a mild hygiene concern without an untrusted trigger or sink.