reefki/pulse-headless

Release historydanger

This is the package's only release, published 843 days ago, with no releases in the last 12 months. That leaves substantial uncertainty about ongoing maintenance.

Repo commit activitydanger

There were zero commits and zero active maintainers in the last three months. Combined with the single historical release, this is strong evidence of currently inactive maintenance.

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. Composer lifecycle scripts can be legitimate, but they add execution behavior during installation that should be understood before adoption.

Repo toolingcaution

The repository uses Composer for its build, but no security-scanning tools were detected. This is a hygiene gap rather than evidence that the package is unsafe by itself.

Workflow auditcaution

All 18 action references are unpinned, and four high-confidence findings identify unpinned container images in the test workflow. The pull_request_target workflow has no untrusted checkout or script-injection finding, so this is a reproducibility and workflow-hygiene concern rather than a severe risk.