woit/wit-cleartempfiles

Lifecycle scriptscaution

The package defines a post-autoload-dump lifecycle script. Composer lifecycle scripts can run code during installation, so this adds a supply-chain review point even though the signal does not establish that the script is unsafe.

Release historycaution

Only two releases were published, both on the same day, with no release in the last 12 months despite the package being about 2 years and 7 months old. This points to limited maintenance, although the package is stable rather than experimental.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, consistent with roughly 22 months since the last recorded push. Organization backing helps, but does not replace recent maintenance activity.

Repo toolingcaution

The repository uses Composer, which is appropriate for this PHP package, but no security scanning tools were detected. That is a transparency and maintenance gap rather than evidence of an unsafe release.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. This is a modest transparency concern for a package integrated into TYPO3 installations.