yggdrasilcloud/core

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, a significant sign that maintenance may have stalled despite the earlier release history.

Workflow auditdanger

All 19 analyzed action references are unpinned, and the audit found high-confidence template-injection findings plus one script-injection finding. No untrusted trigger was reported, so these are serious hygiene concerns but not independently critical.

Licensecaution

The artifact contains an MIT license file, so the release is licensed; however, the manifest declares it as proprietary, creating a material license interpretation mismatch.

Lifecycle scriptscaution

post-install-cmd and post-update-cmd scripts run during dependency operations, adding installation-time behavior that consumers should inspect before adoption.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a meaningful repository hygiene gap for a package with release workflows.