sandermuller/package-boost-php

Lifecycle scriptscaution

The package runs both post-install-cmd and post-update-cmd scripts, so installation and updates execute package-defined code. That is a meaningful supply-chain consideration even though no malware finding is present.

Repo commit activitycaution

Only two commits were recorded in the last three months, which is limited activity for a package with frequent releases. Two active maintainers and the recent repository push partly offset abandonment concerns.

Security policycaution

The linked repository has no security policy, reducing transparency about vulnerability reporting and response. Dependabot and other repository evidence provide some compensating security practice, so this is a minor concern rather than a severe risk.

Workflow auditcaution

All 17 analyzed action references are unpinned, allowing workflow dependencies to change without a repository change; however, all five workflows were audited, four use read-only permissions, and no dangerous sinks or audit findings were reported.