magmodules/magento2-boxo

Release historycaution

This is the package's first release, published today, with only one release and no established release cadence. That limits evidence of sustained maintenance, although the repository and release artifacts are present.

Repo commit activitycaution

There were no commits and no active maintainers in the measured three-month window. Because the repository and package are newly published, this is a maintenance-coverage gap rather than proof of abandonment.

Security policycaution

The repository has no security policy. This is a transparency and vulnerability-reporting gap, though it is not by itself evidence that the code is unsafe.

Workflow auditcaution

All seven workflows were analyzed with no audit findings or untrusted checkouts, but all 22 action references are unpinned and one workflow grants top-level write permission. The unpinned actions weaken build reproducibility; the write permission is a lesser concern without an untrusted trigger.