williamug/money-formatter

Lifecycle scriptscaution

A post-autoload-dump script runs during installation. This is a mild operational consideration, but the signal alone does not show harmful or unusual behavior.

Repo commit activitycaution

The repository has recorded zero commits and zero active maintainers in the last three months, despite the recent release. This creates a meaningful concern about current maintenance capacity.

Repo popularitycaution

The repository has one star and no forks, indicating limited external adoption. Popularity is supporting evidence only, so this mildly reduces confidence in community backing rather than making the package unfit.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools are configured. The security policy and workflow audit partly compensate, though automated security coverage is limited.

Workflow auditcaution

Both workflows were analyzed successfully with no detected injection or high-confidence audit findings. However, all five action references are unpinned and one workflow grants top-level write permission, creating reproducibility and token-scope hygiene concerns.