markwalet/nova-modal-response

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is an execution surface that merits review, although the signal does not show that the script is harmful.

Project backingcaution

The package and repository are owned by the same individual account, providing clear ownership but no organizational backing or broader maintenance capacity.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months, a meaningful recent maintenance gap despite the stronger release history.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

Both workflows were analyzed successfully with no dangerous audit findings or untrusted checkouts, but all 6 action references are unpinned, weakening build reproducibility and supply-chain protection.