undkonsorten/typo3-auto-login

Lifecycle scriptscaution

The package runs post-install and post-update Composer commands, so dependency installation and upgrades execute package-defined automation. This adds supply-chain exposure, although no other provided signal indicates malicious behavior.

Release historycaution

The package has existed for about 8 years, but only one release was published in the last 12 months and the median interval is about 9 months, indicating a slow maintenance cadence.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. This is a meaningful maintenance concern despite a recent release and push being observed elsewhere.

Security policycaution

The repository has no security policy. For a development authentication extension, this reduces transparency around vulnerability reporting, but it is not evidence of abandonment by itself.

Workflow auditcaution

All 9 analyzed action references are unpinned, which weakens build reproducibility. The audit found no untrusted checkouts, script injection, dangerous triggers, or other severity-rated findings, limiting this to caution rather than danger.