knplabs/packagist-api

Repo bus factorcaution

All nine recent commits came from one contributor, so maintenance is vulnerable to contributor availability even though the repository is owned by an organization.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected, leaving security-focused maintenance less visible.

Security policycaution

The repository has no security policy, which is a transparency and vulnerability-reporting gap for a package intended to make HTTP API requests.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings. However, all three action references are unpinned, weakening build reproducibility.