wyrihaximus/react-cache-serialize

Release historydanger

Only two releases exist, and the latest was published over four years ago with no releases in the preceding 12 months. This substantially raises staleness and abandonment concerns.

Workflow auditdanger

The composer-diff workflow combines pull_request_target, an untrusted checkout, and top-level write permissions, creating a meaningful CI risk. All 28 action references are unpinned; the template-injection findings are medium-confidence and occur in a different workflow, so they add hygiene concern rather than a separate severe finding.

Lifecycle scriptscaution

The package declares post-install and post-update Composer scripts. These add install-time execution surface, though the signal alone does not show that the scripts are unsafe.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the project has limited visible ownership redundancy.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Although the repository was pushed recently, the measured recent activity still weakens confidence in ongoing maintenance.