odiseoteam/sylius-referrals-plugin

Lifecycle scriptscaution

The package defines post-create, post-install, and post-update Composer scripts, which increase install-time execution exposure; their presence is a supply-chain hygiene concern even though no maliciousness judgment is made here.

Repo commit activitycaution

No commits and no active maintainers were recorded during the last 3 months. Recent releases and merged pull requests provide some compensating evidence, but the lack of direct commit activity still lowers confidence in sustained maintenance.

Repo toolingcaution

The repository uses Composer build tooling, but no security scanning tools were detected, leaving a security-process gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response practices.

Token permissionscaution

The only workflow lacks top-level token permissions. No write permissions were detected, but explicitly declaring least-privilege permissions would provide stronger CI security hygiene.