nglam2911/invcraft

Release historycaution

This is the package's only release, published about two years ago, with no releases in the last 12 months. That weakens evidence of ongoing maintenance.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. This is a meaningful sign of currently slow maintenance, even though it was pushed in October 2025.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected. That is a modest transparency and hygiene gap rather than a severe dependency risk.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, sinks, or audit findings, and it scopes permissions at job level. However, all four action references are unpinned, reducing build reproducibility and supply-chain hygiene.