react-parallel/worker-pool

Release historydanger

Only one release exists, dated August 2020, with no releases in the last 12 months; this is strong evidence of a potentially stale published package.

Lifecycle scriptscaution

The package defines post-install and post-update Composer scripts, adding install-time execution surface that consumers should understand before adoption.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months, which weakens evidence of ongoing maintenance even though its last push was more recent.

Security policycaution

No security policy is published, leaving vulnerability-reporting expectations unclear for a package intended for integration into applications.

Workflow auditcaution

All 15 analyzed action references are unpinned, and the audit found a medium-confidence template-injection issue in ci.yml; no untrusted checkout or script-injection sink was found, so this is workflow hygiene rather than a severe risk.