vormkracht10/flysystem-uploadcare

Dangerous workflowscaution

One of five workflows uses pull_request_target for Dependabot auto-merge, which warrants review because that event can grant elevated repository context. No untrusted checkouts or script-injection patterns were detected, limiting the concern.

Lifecycle scriptscaution

The package runs a post-autoload-dump lifecycle script during installation. This is a supply-chain and installation-behavior consideration, although the signal does not show that the script is malicious or unusually broad.

Repo issue activitycaution

There are no open issues and five open pull requests, but no issues or pull requests were merged in the last month. This is a modest maintenance-process concern, partly offset by the recent release and commit activity.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and supported disclosure channels undocumented. This is a transparency gap, though it does not by itself indicate abandonment.

Token permissionscaution

Four workflows lack top-level token permissions and one workflow declares top-level write access. The absence of explicit least-privilege defaults and the write-capable workflow reduce CI transparency and hardening.