react-parallel/psr-15-adapter

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts, which increase execution during dependency operations. No provided signal shows those scripts are unsafe, so this is a modest supply-chain caution rather than a severe risk.

Release historycaution

The package has only two releases, both published in September 2020, with no releases in the last six years. This materially raises maintenance and abandonment concerns.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although it was pushed in September 2025, current development activity is still absent.

Security policycaution

The repository has no security policy, reducing transparency for reporting and handling vulnerabilities. This is a minor gap because the project otherwise provides source, tests, and security scanning tooling.

Workflow auditcaution

All 15 analyzed action references are unpinned, and the audit found a medium-confidence template-injection pattern in the CI workflow. No dangerous triggers, untrusted checkouts, or script-injection findings were reported, limiting this to a hygiene concern.