lindemannrock/craft-formie-sms

Lifecycle scriptscaution

The package defines post-install and post-update Composer scripts. These add install-time behavior that consumers should review, although lifecycle scripts are common for CMS plugins and are not inherently unhealthy.

Repo bus factorcaution

All 12 recent commits came from one contributor, creating a genuine continuity risk. Organization ownership partly compensates because maintenance can potentially be handed off, but no second active contributor is shown.

Repo popularitycaution

The repository has no stars, forks, or watchers. This offers no community validation, but popularity is supporting evidence and the package's active release and commit history are stronger indicators here.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. The missing scanning is a transparency and maintenance gap, though it is not by itself evidence that the release is unsafe.

Token permissionscaution

Two workflows declare top-level write permissions and one lacks top-level permissions entirely. This is weaker workflow hardening than a consistently read-only or narrowly scoped setup.