pantheon-systems/pantheon-mu-plugin

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts. These can execute code during dependency operations, creating additional supply-chain exposure even though no specific malicious behavior is shown.

Repo bus factorcaution

Two contributors were active recently, but the leading contributor made 70% of commits. The organization backing provides some handoff capacity, so this is only a modest continuity concern.

Security policycaution

No SECURITY.md or other security policy was found. This is a transparency gap, but it is not evidence that the package is unsafe by itself.

Workflow auditcaution

All 14 analyzed action references are pinned and no untrusted checkout or script-injection sinks were found. However, one workflow file failed auditing and two workflows grant top-level write permissions, producing a limited hygiene concern without a demonstrated dangerous path.