orchestra/canvas

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is a genuine installation-time execution surface, though the signal does not show dangerous behavior or make the package unfit to use.

Repo bus factorcaution

One contributor made all recent commits, giving the project a concentrated short-term contributor base. Organization backing provides some handoff capacity, but the observed activity remains narrow.

Repo commit activitycaution

Only 2 commits were recorded in the last 3 months, indicating limited recent development activity. The recent release history partly offsets this, but the activity is still thin.

Workflow auditcaution

All 5 workflows were analyzed successfully, with no dangerous triggers, untrusted checkouts, script injection, or audit findings; four workflows use read-only permissions. However, all 18 action references are unpinned and one workflow has top-level write permissions, creating modest reproducibility and permission concerns without an untrusted execution path.