xefi/faker-php

Licensecaution

The artifact declares MIT but its license file is detected as Apache-2.0, creating a genuine licensing inconsistency despite a license file also being present in the repository.

Lifecycle scriptscaution

Post-install and post-update Composer scripts add install-time behavior that consumers should understand, but this is a moderate transparency concern rather than a severe health risk on its own.

Repo toolingcaution

Composer is used for builds, but no security-scanning tool was detected. The missing scanner is a modest transparency gap, not evidence of poor maintenance by itself.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unspecified and creating a minor transparency gap.

Workflow auditcaution

Both workflows were analyzed without failed files or dangerous sinks, and one scopes permissions at job level. However, all 5 analyzed action references are unpinned, which weakens build reproducibility and supply-chain hygiene.