wsmallnews/filament-nestedset

Dangerous workflowscaution

One of five workflows uses pull_request_target, which warrants review because that trigger can elevate workflow privileges; no untrusted checkout or script-injection findings were detected, limiting the concern.

Lifecycle scriptscaution

The package uses a post-autoload-dump install-time script, which adds execution and supply-chain surface; the signal does not show that the behavior is malicious, so this is a review item rather than a health verdict.

Maintainerscaution

Only one account has registry publish access, creating some operational concentration; however, registry access records do not measure actual maintenance, and the repository shows two active contributors and recent releases.

Project backingcaution

The source repository is owned by a personal user account rather than an organization, so the small maintainer base has less institutional handoff support; balanced recent contributions partly mitigate this risk.

Token permissionscaution

Three workflows declare top-level write permissions and two omit top-level permissions, leaving broader-than-necessary or unclear token scope in parts of the CI configuration.