idct/php-db-csv-writer

Release historydanger

The package has had no release for over six years: its latest release was January 21, 2020, and it has had no releases in the last 12 months. This is strong evidence of abandonment risk despite its stable version.

Repo popularitycaution

The repository has zero stars and forks and only one watcher. Popularity is not decisive, but these low adoption signals provide little supporting evidence for long-term maintenance.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. That limits evidence of ongoing supply-chain and dependency hygiene.

Security policycaution

The repository has no security policy. This is a transparency gap for a library that handles database loading, although it is less serious than evidence of active abandonment.

Workflow auditcaution

Both workflow action references are unpinned, and the audit found a high-confidence template-injection warning plus a script-injection count in the workflow. No dangerous trigger was reported, so this is a serious hygiene concern rather than a standalone critical finding.