villfa/composer-substitution-plugin

Release historycaution

The package has had no registry release in over four years, and there were no releases in the last 12 months. Its 13-release history shows prior activity but does not offset the current staleness.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. This weakens evidence of ongoing maintenance, although the repository is not archived.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The build setup is established, while security-maintenance coverage is limited.

Security policycaution

The repository has no security policy, reducing transparency for reporting and handling vulnerabilities. This is a moderate hygiene gap rather than evidence that the package is unsafe.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous triggers or audit findings, but all 9 of 9 action references are unpinned. That leaves avoidable build-integrity and maintenance risk.