jord-jd/php-hcl-parser

Lifecycle scriptscaution

A post-autoload-dump install-time script increases supply-chain exposure because package installation executes project code. The documented checksum verification is a compensating control, but the lifecycle behavior still warrants caution.

Repo bus factorcaution

All two recent commits came from one contributor, so maintenance depends heavily on a single person and has limited demonstrated redundancy.

Repo commit activitycaution

The repository had two commits in the last 3 months, showing recent activity but only modest maintenance capacity for a package with a long history.

Security policycaution

The linked repository has no security policy, reducing transparency about vulnerability reporting and response expectations.

Workflow auditcaution

All two analyzed action references are unpinned, which weakens build reproducibility. The audit found no dangerous triggers, untrusted checkouts, script injection, or other reported findings, limiting the concern to workflow hygiene.