automattic/woocommerce-analytics

Lifecycle scriptscaution

Composer post-install and post-update scripts add install-time execution risk and deserve review, even though they are not by themselves evidence of an unhealthy project.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and defense-in-depth gap.

Workflow auditcaution

Both workflows were analyzed with no audit findings and no untrusted checkout or script-injection paths. One workflow has top-level write permissions and one of two action references is unpinned, creating mild workflow hygiene concerns.