openstatspec/spss-sav

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts. These add install-time execution surface and deserve review, although this signal alone does not show harmful behavior.

Repo bus factorcaution

All 39 recent commits came from one contributor, creating a real continuity risk. Organization ownership provides some handoff capacity, but no second active contributor is shown in this period.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no detected dangerous sinks or audit findings. However, all seven action references are unpinned, which weakens build reproducibility and supply-chain hygiene.