lindemannrock/craft-smart-links

Registry deprecationdanger

Packagist marks the entire package abandoned and names craft-smartlink-manager as its replacement. Package-level deprecation is a severe adoption risk despite the repository remaining active.

Lifecycle scriptscaution

The package runs post-install-cmd and post-update-cmd scripts, adding installation-time behavior that consumers must account for. This is a supply-chain hygiene concern, not evidence of maliciousness by itself.

Repo bus factorcaution

All 47 recent commits came from one contributor, leaving maintenance highly concentrated. Organization backing provides some handoff capacity, but no second active contributor is shown.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the linkage is less transparent than expected. The package's substantial source tree partly reduces concern, but does not remove it.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkout or script-injection findings, but all six action references are unpinned and two workflows grant top-level write permissions. These are workflow hygiene concerns without an identified untrusted trigger or sink.