vanssa/sylius-slider-plugin

Lifecycle scriptscaution

The package runs post-create-project-cmd and post-root-package-install scripts during Composer operations. These are not shown as malicious, but install-time execution adds avoidable supply-chain exposure.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the small maintainer base provides less formal handoff capacity.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.

Workflow auditcaution

The sole workflow was fully analyzed with no untrusted checkout, script injection, or high-severity findings, but all three action references are unpinned, reducing build reproducibility and action-integrity protection.