increstive/mpdf

Release historydanger

The package has 58 releases, but its latest release was in March 2022 and it has had no releases in the last 12 months. That prolonged inactivity is a substantial abandonment concern for a library dependency.

Lifecycle scriptscaution

A post-install-cmd script runs during installation, increasing installation complexity and the amount of package behavior that must remain maintained. No provided signal shows that this script is harmful, so this is a hygiene concern rather than a severe risk.

Repository archivedcaution

The linked repository is not archived, which is a positive counterpoint, but its last push was also in March 2022 and does not offset the stale release history.

Security policycaution

The repository has no security policy or security-scanning tooling. This weakens vulnerability-reporting and maintenance transparency, although it does not by itself show that the package is unsafe.

Workflow auditcaution

All 6 analyzed action references are unpinned, so workflow dependencies can change without a reviewed package release. The audit found no untrusted checkouts, injection sinks, dangerous triggers, or high-severity findings, which limits this to a hygiene concern.