hollodotme/iso-country-codes

Lifecycle scriptscaution

The package defines post-install and post-update Composer scripts, adding code that runs during dependency operations. Their presence is a build-trust concern even though this signal does not show malicious behavior.

Release historycaution

This is a single-release package first published on August 17, 2020, with no releases in the last 12 months and no later registry release observed. The stable version and release notes provide some transparency, but the long release gap lowers confidence in ongoing maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months, consistent with the package having been unchanged for over six years. That may be acceptable for static data, but it leaves little evidence of current maintenance capacity.

Workflow auditcaution

All four analyzed action references are unpinned, and the release workflow has two high-confidence template-injection findings. There is no untrusted checkout or script-injection trigger reported, so these are workflow hygiene and reproducibility concerns rather than a severe standalone risk.