luguohuakai/packme

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. A release was published during that period, but the lack of observed development activity still raises abandonment and maintenance concerns.

Repo popularitycaution

The repository has only 2 stars and 1 fork, providing little independent evidence of broad community use or review. Low popularity is supporting caution, not a verdict by itself.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. That leaves a meaningful verification gap for a package used in deployment workflows.

Security policycaution

The repository has no security policy. This weakens vulnerability-reporting transparency, although it does not by itself indicate an unsafe release.

Workflow auditcaution

Both workflows were fully analyzed with no dangerous sinks or audit findings, but all six action references are unpinned and one workflow grants top-level write permissions. These are release-hygiene weaknesses without evidence of an exploitable workflow path.