lindemannrock/craft-formie-paragraph-field

Lifecycle scriptscaution

Composer post-install and post-update scripts run during dependency operations, which adds some install-time behavior to review, but this signal alone does not show harmful activity.

Repo bus factorcaution

All 10 recent commits came from one contributor, creating a real continuity risk. Organization ownership provides some handoff capacity, but no second active contributor is shown here.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. That is a modest process gap rather than evidence of unsafe code.

Workflow auditcaution

All three workflows were analyzed without untrusted checkouts or script-injection findings, but all six action references are unpinned and two workflows grant top-level write permissions. With no untrusted trigger or sink, this is workflow hygiene risk rather than a severe supply-chain finding.