ryangjchandler/commonmark-blade-block

Lifecycle scriptscaution

A post-autoload-dump script runs during installation. This is a point to inspect in a dependency, but the signal alone does not show unsafe behavior.

Release historycaution

The package has only three releases across roughly two years, with one release in the last 12 months and a median interval of about 259 days. This indicates a small, slow-moving project rather than active release maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. The June push and March release partly compensate, but recent development activity is currently thin.

Security policycaution

The repository has no security policy. That is a transparency gap for reporting vulnerabilities, though it does not by itself show that the package is unsafe.

Workflow auditcaution

All 12 analyzed action references are unpinned, and three workflows grant top-level write permissions. The audit also found a high-confidence bot-condition issue in a pull_request_target workflow; no untrusted checkout or script injection was detected, limiting the severity.