⚠️ This package seems to have moderate severity install script vulnerabilities

Affected script: "install-scripts:post-install-cmd"

The provided script installs a PHP package using phive, a tool for managing PHP packages. The flags --force-accept-unsigned and --trust-gpg-keys followed by various keys indicate that the script will force the installation of packages even if they are unsigned or signed with keys not originally trusted. This could lead to the installation of malicious software, as it bypasses an important security measure designed to ensure that only trusted, verified packages are installed.

Generated on May 4, 2024 via composer

Repo

Composer

Home

sitepark/github-composer-release-test 1.2.0

Test project to test the release process with Github Actions

Package summary

issue

license

Package created

23 Oct 2023

Version published

20 Oct 2023

Maintainers

Total deps

Direct deps

License

MIT

Issues

1 high severity issue

high

sitepark/github-composer-release-test@1.2.0

Package uses post-install-cmd script: "phive --no-progress install --force-accept-unsigned --trust-gpg-keys C00543248C87FB13,4AA394086372C20A,CF1A108D0E7AE720,51C67305FFC2E5C0"

via: sitepark/github-composer-release-test@1.2.0

Collapse

Expand

Licenses

MIT License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

Cannot

hold-liable

Must

include-copyright

include-license

1 Packages, Including:

sitepark/github-composer-release-test@1.2.0

Direct Dependencies

All Dependencies CSV

ⓘ This is a list of sitepark/github-composer-release-test 's direct dependencies. Data on all dependencies, including transitive ones, is available via CSV download.