adereksisusanto/laravel-artisan

Dangerous workflowscaution

One of six workflows uses pull_request_target, which warrants review because it runs with elevated trust, but no untrusted checkout or script-injection patterns were detected.

Maintainerscaution

Only one registry account has publish access. This is consistent with the repository being user-owned, but it provides little publishing redundancy when combined with the single-contributor repository activity.

Project backingcaution

The registry namespace and repository are owned by the same individual rather than an organization, so there is no organizational handoff capacity to offset the single-maintainer risk.

Release historycaution

There have been 9 releases in the last 12 months, but the package is only 76 days old and its median release interval is about 2 hours, so long-term maintenance is not yet established.

Repo bus factorcaution

One contributor made all 31 recent commits, leaving maintenance highly dependent on a single person and creating a meaningful continuity risk.