qbus/pdfclean

Release historydanger

The package has had only two releases, both on November 18, 2022, with no releases in the last 12 months. Nearly four years without a release is strong evidence of abandonment risk.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap and indicating no recent maintenance capacity.

Lifecycle scriptscaution

A post-autoload-dump install-time script runs during Composer operations. This adds execution and maintenance surface, though the signal does not show that the script is malicious or unusually broad.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. This is a transparency gap, but it does not outweigh the much stronger maintenance evidence.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, injection findings, or high-confidence audit findings. Both action references are unpinned, which is a modest reproducibility and supply-chain hygiene concern.