yard/brave-components
Collection of logic-heavy components used in Brave projects.
82%
Total Score
healthy
Active releases and a healthy contributor base outweigh workflow pinning and secret-handling gaps.
Health Score Breakdown
The package uses a post-autoload-dump install-time script. This is common Composer behavior, but it adds execution during installation and warrants normal review of the script implementation.
The repository has 0 stars and 0 forks, with 2 watchers. This provides little external adoption evidence, though popularity is supporting evidence rather than a health verdict.
No security policy is present in the repository. This is a transparency gap for vulnerability reporting, although active Dependabot coverage partially compensates for it.
All seven workflows were analyzed, with no untrusted checkout or script-injection findings. However, all seven action references are unpinned, six workflows inherit secrets broadly, and one workflow grants top-level write permissions, creating workflow hygiene and credential-scope concerns.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
No maintainer information available.
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 roots/acorn Version ^5.0 | — | — |
yard/wp-hook-registrar Version * | — | — |
spatie/laravel-package-tools Version ^1.16 | — | — |
Weekly Downloads
Info
- Last Published
- 14 days ago
- Created
- 1 year ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.