sybio/permission-bundle

Maintainerscaution

One registry maintainer is a thin publishing base, although the linked repository is owned by the same individual, so this is a capacity concern rather than a mismatch.

Release historycaution

The package has only two releases, both within eight days, and no release activity for about nine months despite being 276 days old. This leaves limited evidence of sustained maintenance.

Repo commit activitycaution

The repository has recorded zero commits and zero active maintainers in the last three months, consistent with the long gap since the last release. That raises abandonment risk for a young package.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and maintenance gap, not evidence that the package is unsafe.

Workflow auditcaution

The workflow has no untrusted trigger or audit finding, but all 3 of 3 action references are unpinned, so they can change without a repository commit. The missing top-level permissions block is common and not a concern by itself.