opscale-co/nova-webhooks

Dangerous workflowscaution

Four workflows were analyzed; one uses pull_request_target, which can elevate workflow risk. No untrusted checkout or script-injection patterns were detected, partially compensating for the concern.

Dependency profilecaution

Five runtime dependencies are declared, including several organization-maintained packages and a webhook server library. The dependency surface is material but not unusually large for this integration package.

Lifecycle scriptscaution

The package uses a post-autoload-dump install-time script. This adds execution during installation and should be reviewed, although the signal does not show that the script is destructive or otherwise unsafe.

Package scaffoldingcaution

A substantial README and changelog are present, and the repository uses GitHub Releases, but neither the artifact nor repository contains tests. The missing tests are a genuine verification gap for a library package.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months. Although the latest release was pushed recently, the observed short-term development inactivity is a meaningful maintenance concern.