microweber-deps/radio-deck

Lifecycle scriptscaution

A post-autoload-dump lifecycle script runs during installation. This adds execution surface to dependency installation, but the signal does not show that the script is harmful or unusually broad.

Release historycaution

This is the sole release, published 425 days ago, with no releases in the last 12 months. That leaves maintenance and compatibility uncertain for a package developers may need to keep current.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the single-release history and indicating a real abandonment risk.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and maintenance gap rather than evidence that the package is unsafe.

Workflow auditcaution

All three workflows were analyzed with no reported audit findings or untrusted checkouts, but all 8 action references are unpinned and two workflows grant top-level write permissions. The unpinned actions reduce build reproducibility, while the write permissions are a moderate hygiene concern without an identified untrusted trigger.