aldesrahim/laravel-timezone-indonesia

Workflow auditdanger

All 12 action references are unpinned, and the audit found a high-confidence template-injection issue in sync-data.yml; two workflows also grant top-level write permissions. No untrusted checkout or script-injection trigger was detected, but the workflow setup still warrants caution.

Maintainerscaution

One registry maintainer is consistent with a small user-owned project, but it leaves limited publishing redundancy.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single registry maintainer and concentrated commit activity have limited institutional backing.

Release historycaution

The package is only 40 days old with two releases, both published on the same day, so there is limited evidence of long-term maintenance stability.

Repo bus factorcaution

Two contributors are active, with the top contributor responsible for 75% of recent commits. The second contributor provides some continuity, but ownership remains concentrated.