hyperf/paginator

Dangerous workflowscaution

One of two workflows uses pull_request_target, which can increase workflow risk when handling untrusted pull requests. No untrusted checkout or script-injection patterns were detected, limiting the severity.

Package scaffoldingcaution

The published artifact has no README, but it includes a GitHub release with notes linking the exact version change, and the repository contains tests. The missing artifact README is a consumer-documentation gap but not an abandonment signal by itself.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. Although the same period includes a package release, the absence of observed development activity lowers confidence in ongoing maintenance.

Repo toolingcaution

Composer is used as the build tool, but no security scanning tools were detected. The missing scanner is a process gap, though it is not by itself evidence that the package is unsafe or abandoned.

Token permissionscaution

Both analyzed workflows lack top-level token permissions declarations. No workflow requests top-level write access, but explicitly restricting permissions would provide stronger CI security hygiene.