lindemannrock/craft-plugin-base

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts, which increase installation-time behavior and supply-chain exposure compared with a package without lifecycle hooks.

Repo bus factorcaution

All 47 recent commits came from one contributor, creating a real continuity risk. Organization ownership provides some ability to hand maintenance off, but no second active contributor is shown.

Repo toolingcaution

Composer build tooling is used, but no security scanning tool is reported, leaving a modest transparency and detection gap alongside otherwise clear build support.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkout, injection, or auditor findings. However, all six action references are unpinned and two workflows grant top-level write permissions, creating workflow hygiene and token-scope concerns without an observed untrusted sink.