webhook-ledger/webhook-ledger-bundle

Maintainerscaution

One registry maintainer is a modest bus-factor concern for a user-owned project, with no organization backing shown to compensate for that narrow publishing base.

Release historycaution

The package was released three times within its first day, showing active initial publishing but not yet enough history to demonstrate sustained maintenance.

Repo commit activitycaution

No commits or active maintainers were observed in the last three months. Because the package is only about one day old, this primarily indicates limited maturity rather than established abandonment.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a meaningful repository hygiene gap for a package handling webhook data.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all three action references are unpinned, reducing build reproducibility and supply-chain protection.