marcogermani87/filament-cookie-consent

Lifecycle scriptscaution

The package runs a post-autoload-dump installation lifecycle script. This is an additional install-time execution surface, though the signal does not show malicious behavior or unusually broad scripting.

Release historycaution

The package has seven releases over about 2 years and a latest release in December 2025, but only one release in the last 12 months indicates a slower cadence.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last 3 months. A recent release and push provide some compensating evidence, but current maintenance activity is limited.

Security policycaution

No security policy is present, which leaves vulnerability reporting and handling less transparent for a package used in applications.

Workflow auditcaution

All 12 action references are unpinned, and three workflows grant top-level write access. The audit also found a high-confidence bot-condition issue in a Dependabot auto-merge workflow; no untrusted checkout or script injection was found, limiting the severity.