lindemannrock/craft-component-manager

Lifecycle scriptscaution

post-install-cmd and post-update-cmd scripts run during dependency operations, adding execution exposure that deserves review even though the signal does not establish harmful behavior.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the past three months, a meaningful sign that maintenance may have slowed despite the recent release history.

Workflow auditcaution

All six analyzed action references are unpinned, and two of three workflows grant top-level write permissions. No untrusted triggers, checkout sinks, or audit findings were reported, so this is a hygiene caution rather than a severe workflow risk.