jeffersongoncalves/mobilekit

Lifecycle scriptscaution

The package runs post-autoload-dump, post-create-project-cmd, post-root-package-install, and post-update-cmd scripts, increasing install and update-time execution risk for consumers.

Project backingcaution

The package and repository are owned by the same individual account, so the project has clear ownership but no organizational backing indicated by this signal.

Repo bus factorcaution

Two contributors are active, with the leading contributor responsible for 60% of recent commits; the second contributor provides meaningful but limited redundancy.

Workflow auditcaution

All 6 workflows were analyzed with no untrusted checkouts, script injection, or unpinned actions, but a high-confidence bot-conditions finding remains in dependabot-auto-merge.yml and 3 workflows grant top-level write permissions.