waynestate/wayne-ui

Release historycaution

The package is young at 45 days and published nine releases, all within the last 12 months, with a median interval of about 8 hours. This shows active initial iteration but provides limited long-term maintenance history.

Repo popularitycaution

The repository has one star, zero forks, and one watcher. This is limited supporting evidence, but popularity is not required for a small organization-owned design system.

Repo toolingcaution

Composer is used as a build tool, supporting a defined build process. No security-scanning tool was detected, leaving a modest repository hygiene gap.

Security policycaution

The repository has no SECURITY.md or other detected security policy. This reduces vulnerability-reporting transparency, although it is not evidence that the package is unsafe.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkout or script-injection path, but it grants top-level write permissions, leaves all 3 of 3 action references unpinned, and has a high-severity cache-poisoning finding at low confidence plus a high-confidence adhoc-package finding. These are build-hygiene and reproducibility concerns, not standalone evidence of an unfit release.