ace-of-aces/laravel-image-transform-url

Maintainerscaution

Only one account has registry publish access. The matching repository and regular release history provide some compensation, but the publishing base remains narrow.

Project backingcaution

The repository and registry are owned by the same individual account, so the package has direct ownership alignment but no demonstrated organizational backing.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. A recent push and three merged pull requests show some activity, but the current commit pause raises maintenance risk.

Security policycaution

No repository security policy was found. This is a transparency and vulnerability-reporting gap, though it does not by itself show that the package is unsafe.

Workflow auditcaution

All six workflows were analyzed with no untrusted checkout or script-injection findings and all 21 action references pinned. However, the audit found one high-confidence template-injection issue in bump-docs-version.yml; template injection is a workflow hygiene concern unless corroborated by an exploitable trigger or sink.