webgriffe/sylius-active-campaign-plugin

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts. These are common for PHP packages, but they add installation-time behavior that consumers should understand.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. This is a meaningful maintenance concern, although the release history shows the package was published recently.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the package-to-source relationship is less transparent even though the repository owner matches the registry organization.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.

Workflow auditcaution

All 15 analyzed action references are unpinned, and a high-confidence audit finding identifies an archived action; these weaken workflow supply-chain hygiene. The cache-poisoning findings are low confidence and do not materially change the assessment.