adampatterson/laravel-csv-translations

Dangerous workflowscaution

One workflow uses pull_request_target for automated Dependabot merging, which warrants attention because that trigger can have elevated repository access; no untrusted checkout or script-injection findings were observed.

Lifecycle scriptscaution

A post-autoload-dump install-time script is present. This is a real execution point during installation, but the signal provides no evidence that it is unusually risky or excessive.

Release historycaution

This package is about 211 days old but has only one release, so there is not enough release history to demonstrate sustained maintenance.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months; combined with the single-release history, this raises concern that maintenance may have slowed substantially.

Security policycaution

No security policy was found. This is a transparency gap for reporting vulnerabilities, though it is less serious for a small package with other security tooling present.