realrashid/sweet-alert

Dangerous workflowscaution

Five workflows were analyzed with one pull_request_target workflow, but no untrusted checkouts or script-injection patterns were detected. The isolated pull_request_target use should still be reviewed because it can carry elevated workflow context.

Lifecycle scriptscaution

A post-autoload-dump install-time script is present, so dependency installation can execute package code; this is a review point even though only one conventional Composer lifecycle hook is reported.

Maintainerscaution

Only one registry account, Rashid Ali, has publish access. The repository owner is also identified as an individual rather than an organization, so there is limited visible publishing redundancy.

Project backingcaution

The repository is owned by the individual account realrashid rather than an organization, so there is no observed organizational backing to offset the single-publisher concern.

Repo commit activitycaution

The repository reports zero commits and zero active maintainers over the last 3 months. This conflicts with the recent release, push, and pull-request activity and is a meaningful warning about current maintenance continuity.