katalam/pest-plugin-translatable

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script, which adds execution during installation and modestly increases supply-chain exposure. No evidence here shows that the script is malicious or unusually broad.

Release historycaution

The package has only two releases, both published in August 2024, with no releases in the last 12 months. This suggests limited maintenance momentum for a dependency last released about two years ago.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, consistent with a project that is no longer actively maintained. The repository is not archived, but that does not compensate for the lack of recent activity.

Security policycaution

The repository has no documented security policy, leaving vulnerability-reporting and response expectations unclear. This is a transparency gap, not evidence that the package is unsafe.

Workflow auditcaution

All four analyzed workflow action references are unpinned, which weakens build reproducibility. The audit found no untrusted checkouts, script injection, high-severity findings, or top-level write permissions, limiting the impact to caution.