hwkdo/intranet-app-assets

Lifecycle scriptscaution

The package runs a post-autoload-dump lifecycle script during installation. This is a meaningful install-time surface and deserves caution even though the signal does not show that the script is harmful.

Project backingcaution

The repository is owned by a user account rather than an organization, so there is no provided organizational backing to offset the concentrated contributor activity. The matching registry and repository owner still support package identity.

Repo bus factorcaution

One contributor made all 33 commits in the last three months, leaving no demonstrated handoff capacity. This creates a real continuity risk for a package with frequent ongoing changes.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected. The missing scanning is a modest transparency and maintenance gap rather than evidence that the package is unsafe.

Security policycaution

The repository has no security policy. For a package that manages intranet asset workflows and database records, the lack of a documented reporting process reduces transparency.