openeuropa/oe_subscriptions

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts. These may be legitimate for Drupal packaging, but they expand install-time execution and deserve review before allowing automated installation.

Repo bus factorcaution

One contributor made all six recent commits, creating a real continuity risk; organizational backing provides some ability to hand maintenance off but does not remove the concentration.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and supply-chain hygiene gap.

Security policycaution

The repository has no security policy, making vulnerability reporting and maintainer response expectations less clear.

Version stabilitycaution

The assessed version is still a beta and all recent releases are prereleases, so API and behavior stability are less certain than for a stable release.