hyperf/hyperf-skeleton

Licensecaution

The artifact declares Apache-2.0 but its LICENSE file is detected as MIT, creating an unclear licensing position despite license files being present in both the artifact and repository.

Lifecycle scriptscaution

The package defines four install and update lifecycle scripts. These warrant attention because they execute package logic during Composer operations, but the signal alone does not establish a health failure.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the past three months, a meaningful sign of a recent maintenance lull despite the recent release history.

Repo toolingcaution

The project uses Composer, but no security scanning tools were detected. This is a transparency and hygiene gap, not evidence that the release is unsafe.

Workflow auditcaution

Both workflows were analyzed with no untrusted checkout or script-injection paths, but all 3 action references are unpinned and a high-confidence medium-severity archived action was found in the release workflow.