hyperf/cache

Dangerous workflowscaution

One of two workflows uses pull_request_target, which can increase automation exposure, although no untrusted checkout or script-injection patterns were detected.

Package scaffoldingcaution

The published artifact has no README, which makes integration harder for a library, but the repository has tests and this exact version has GitHub release notes.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, a real maintenance concern despite the recent registry release history.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a transparency and maintenance-control gap.

Token permissionscaution

Both analyzed workflows lack top-level token permissions declarations. No workflow requests top-level write access, but explicit least-privilege settings are still absent.