idmarinas/composer-plugin

Release historycaution

Only one release was published in the last 12 months, despite a much shorter historical median release interval, indicating a substantial slowdown in delivery.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which is a clear recent-maintenance concern.

Repo popularitycaution

The repository has zero stars and forks and one watcher, indicating limited external adoption; this is supporting caution rather than a verdict by itself.

Security policycaution

No repository security policy was found, reducing transparency for reporting and handling vulnerabilities, although this is a secondary concern for the score.

Workflow auditcaution

Both workflow action references are unpinned, and one workflow file failed the audit, so the result is incomplete and reproducibility is weaker. The pull_request_target trigger has no untrusted checkout or script-injection sink, so it is not dangerous on its own.