swag/demo-data

Release historycaution

There have been no releases in the last 12 months, and the latest registry release was on February 27, 2025. Recent repository commits partly offset abandonment concerns, but the published release cadence remains a maintenance caveat.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, creating uncertainty about the package-to-repository link. Organization backing and the matching Shopware demo-data source reduce, but do not remove, that transparency concern.

Security policycaution

The repository has no security policy. This is a transparency gap, though the active organization-owned project and Dependabot provide some compensating maintenance evidence.

Workflow auditcaution

All eight workflows were analyzed, but seven of nine action references are unpinned and one workflow grants top-level write access. Five high-confidence template-injection findings are hygiene concerns; no untrusted checkout, script-injection, pull_request_target, or workflow_run path was reported, so this is not a severe workflow risk.