albertoarena/laravel-event-sourcing-generator

Lifecycle scriptscaution

A post-autoload-dump install-time script runs during Composer installation, which deserves awareness because lifecycle code executes automatically, though this signal alone does not show unsafe behavior.

Project backingcaution

The registry namespace and repository are owned by the same individual, so the single-person maintainer concentration is not offset by organization backing.

Repo bus factorcaution

All 51 recent commits came from one contributor, so maintenance depends heavily on a single person and has limited redundancy.

Token permissionscaution

Three workflows omit top-level permissions and two declare top-level write permissions, which is weaker workflow least-privilege hygiene even though no dangerous workflow pattern was detected.