mralaminahamed/ninja-forms-stubs

Lifecycle scriptscaution

post-install-cmd and post-update-cmd scripts run during Composer operations, adding execution exposure beyond ordinary package loading. No provided signal shows these scripts are harmful, so this is a hygiene concern rather than a severe risk.

Maintainerscaution

Only one account has registry publish access. The linked repository is user-owned rather than organization-backed, so there is no provided organizational capacity to compensate for this concentrated publishing responsibility.

Repo bus factorcaution

All 14 recent commits came from one contributor, leaving no demonstrated backup maintainer. The active commit rate helps, but the repository is user-owned and provides no organizational handoff capacity.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. For a small generated-stub package this is a modest transparency and maintenance gap, not evidence of unsafe code.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency, although the package's narrow stub-focused role limits the practical impact.