shopper/starter-kits

Release historycaution

The package has had no registry releases in the last 12 months, and its latest release is about 19 months old. This is a meaningful freshness concern despite the six-release history.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, weakening evidence of ongoing maintenance even though it is not archived.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and maintenance gap for a package with executable source and workflows.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. This lowers transparency but is not severe enough to make the release unfit on its own.

Workflow auditcaution

Both workflow action references are unpinned, and the validator workflow has high-confidence template-injection findings. No untrusted checkout or script-injection trigger was detected, so these remain workflow-hygiene concerns rather than a severe risk.