react-inspector/http-middleware

Lifecycle scriptscaution

The package defines post-install and post-update Composer scripts, which add install-time execution surface. The signal does not show that these scripts are harmful, so this is a limited supply-chain hygiene concern.

Release historycaution

The package has made 7 releases over about 6 years, but none in the last 12 months and the median interval is about 270 days. Recent repository pull requests provide some compensating activity, but the release cadence remains slow.

Repo commit activitycaution

The repository records zero commits and zero active maintainers in the last 3 months. Pull-request activity offers some evidence of ongoing maintenance, but direct commit activity is currently thin.

Security policycaution

The repository has no security policy. This weakens vulnerability-reporting transparency, although it does not by itself show that the package is unsafe.

Workflow auditcaution

Both analyzed workflows grant top-level write permissions and all 2 action references are unpinned, weakening build reproducibility and limiting token scope. No untrusted checkout, script injection, or auditor findings were reported, which keeps this at caution rather than danger.