rajentrivedi/transaction-x

Release historydanger

The package has only one release, published about 2 years and 10 months ago, with no releases in the last 12 months. That is a substantial maintenance concern despite the stable 1.0.0 version.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last 3 months. Combined with the one-release history, this points to weak ongoing development activity.

Workflow auditdanger

All 12 analyzed action references are unpinned, three workflows grant top-level write permissions, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, but the confirmed workflow issue still materially raises automation risk.

Lifecycle scriptscaution

The package uses a post-autoload-dump install script. This is a legitimate Composer integration point, but it adds install-time behavior that should be understood before adoption.

Maintainerscaution

Only one registry account has publish access, and the project is owned by an individual rather than an organization. This creates limited redundancy if the maintainer becomes unavailable.