wave8/factotum-base

Lifecycle scriptscaution

The package defines a post-autoload-dump lifecycle script, so installation can execute package code. This is common for framework packages but still adds installation-time execution surface.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Frequent registry releases provide some compensation, but this still raises a meaningful maintenance risk.

Security policycaution

No security policy was found in the repository. This is a transparency gap for a framework handling authentication, permissions, media, and other application data.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous sinks or audit findings, but both of its two action references are unpinned. That weakens build reproducibility and action supply-chain protection.