jakuborava/wapi

Lifecycle scriptscaution

The package defines a post-autoload-dump install-time script. Composer lifecycle hooks can be legitimate, but they execute automatically during installation and add supply-chain exposure that should be understood before adoption.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months. Recent registry releases partly offset this, but the lack of current source activity raises maintenance risk.

Security policycaution

The repository has no security policy and no security scanning tools. For an API client handling credentials and network requests, this leaves security reporting and automated checks less transparent.

Workflow auditcaution

All 8 analyzed GitHub Actions uses are unpinned, reducing build reproducibility, although all workflows were analyzed and no untrusted checkouts, script injection, dangerous triggers, or audit findings were reported. The workflows also lack top-level permission blocks, which is acceptable on its own.