slothsoft/blob

Release historycaution

The package has 16 releases since 2018, but none in the last 12 months; recent repository activity partly offsets the slower registry cadence.

Repo bus factorcaution

All three recent commits came from one contributor, leaving maintenance dependent on a single active person.

Repo toolingcaution

The project uses Composer for builds, but no security-scanning tools were detected; this is a modest transparency gap for a dependency project.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations undocumented.

Workflow auditcaution

The audit completed cleanly with no untrusted checkouts or script injections, but all 11 action references are unpinned and one workflow grants top-level write access; no dangerous trigger connects that access to untrusted code.