liaison/revision

Release historydanger

The package has had no registry release in over five years, despite a mature five-release history, which raises abandonment risk.

Repo commit activitydanger

There were no commits and no active maintainers in the last three months, a concrete sign that maintenance may have stalled.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected, leaving release-integrity checks less transparent.

Security policycaution

The repository has no published security policy, reducing clarity about vulnerability reporting and maintainer response.

Workflow auditcaution

All seven analyzed action references are unpinned, and a high-confidence archived-action finding appears in the release workflow. The cache-poisoning findings are low confidence and do not materially add risk.