hwkdo/intranet-app-hwro

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. Lifecycle execution adds review and installation risk, although this signal does not show that the script is harmful.

Package scaffoldingcaution

The artifact includes a README and changelog, and the repository has tests and a changelog, but the README still contains template language such as “This is where your description should go.” That weakens consumer documentation despite the otherwise useful packaging structure.

Repo bus factorcaution

All seven recent commits came from one contributor, leaving no demonstrated second maintainer to provide continuity. The repository is user-owned rather than organization-owned, so project backing does not compensate for this concentration.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. The missing scanning is a modest transparency and maintenance gap, not evidence of a vulnerable release.

Security policycaution

The repository has no security policy, leaving no documented path for reporting vulnerabilities or describing response practices. This is a documentation gap that modestly lowers dependency confidence.