solution-forest/tab-layout-plugin

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is a supply-chain and installation-behavior consideration, though the signal does not show a dangerous script action.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. That recent pause lowers confidence in ongoing maintenance, even though the project has a recent release and a longer release history.

Security policycaution

No SECURITY.md or equivalent security policy was found. This is a transparency gap for a maintained package, though it does not by itself indicate unsafe code.

Workflow auditcaution

All eight analyzed action references are unpinned, all three workflows grant top-level write permissions, and a high-confidence template-injection finding was reported. No untrusted checkout or script-injection trigger was found, so these are workflow-hygiene concerns rather than a standalone severe risk.