shipstream/fedex-rest-sdk

Lifecycle scriptscaution

post-install-cmd and post-update-cmd scripts run during dependency operations, adding some execution and maintenance complexity compared with a package without lifecycle hooks.

Repo bus factorcaution

All 3 recent commits came from one contributor, creating a concentrated maintenance dependency; organization ownership provides some ability to hand off responsibility.

Repo toolingcaution

Composer is used for builds, but no security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no security policy, which reduces transparency about vulnerability reporting and maintenance expectations.

Workflow auditcaution

The single workflow was fully audited, uses read-only permissions, and has no untrusted checkout or injection findings. However, all 3 action references are unpinned, weakening build reproducibility and action supply-chain control.