spryker-shop/suite

Dependency profilecaution

The package declares 239 runtime dependencies and 28 development dependencies, creating substantial upgrade and transitive-maintenance burden for adopters.

Lifecycle scriptscaution

post-install-cmd and post-update-cmd scripts run during dependency operations, adding operational and supply-chain exposure, although this is not by itself evidence of abandonment.

Repo package mentioncaution

The linked repository is named b2c-demo-shop rather than spryker-shop/suite, and its README does not mention this package. That leaves some uncertainty that the repository is the exact source for this package.

Security policycaution

The repository has no SECURITY.md or other declared security policy, leaving vulnerability reporting and response guidance unclear.

Workflow auditcaution

All 10 workflows were analyzed with no failed files or untrusted-checkout/script-injection findings, but 30 of 32 uses are unpinned, one high-confidence finding flags an unpinned container image, and high-confidence secrets-inherit findings widen credential exposure.