adam-dziuk/laravel-agent-cost

Project backingcaution

The registry namespace and repository belong to the same individual account, so the package has consistent ownership. Individual ownership also means the maintainer base is inherently narrow.

Release historycaution

This is the first and only release, published less than a day ago, so there is no track record yet for maintenance or reliable release cadence.

Repo commit activitycaution

The repository has no commits from the last three months and no active maintainers in that window. Because the project was created and released less than a day ago, this is mainly an absence of history rather than evidence of abandonment, but ongoing maintenance remains unproven.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. This is a modest transparency gap rather than a severe risk, especially because other repository checks are present.

Token permissionscaution

Two workflows omit top-level permissions and two request top-level write permissions. The signal does not show excessive job-level access, but narrower explicit permissions would reduce CI supply-chain exposure.