hyperf/polyfill-coroutine

Dangerous workflowscaution

One of two workflows uses pull_request_target, which can increase CI exposure if untrusted pull-request data is handled unsafely. No untrusted checkout or script-injection patterns were detected, limiting the concern.

Package scaffoldingcaution

The artifact is very small and lacks a README, tests, and changelog, which limits consumer guidance and visible project validation. A GitHub release with notes for this exact version provides some documentation of the change.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is concerning for maintenance continuity, although the recent release provides limited compensating evidence.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. For a small PHP package this is a hygiene gap rather than evidence that the release is unfit.

Token permissionscaution

Neither workflow declares top-level token permissions. Although no workflow requests explicit write access, the missing declarations reduce CI privilege transparency.