alexjustesen/laravel-placehold-image

Lifecycle scriptscaution

A post-autoload-dump install-time script is declared. This adds execution during installation and deserves review, but the signal alone does not show that the script is unsafe or unusually broad.

Project backingcaution

The registry namespace and repository are owned by the same individual, and the repository is user-owned. This establishes clear ownership but does not provide organizational succession.

Repo bus factorcaution

Only one contributor made the repository's single commit in the last three months, accounting for 100% of recent activity. The linked project is user-owned rather than organization-backed, so there is little observed maintenance redundancy.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a modest transparency and maintenance gap rather than evidence of an unsafe release.

Workflow auditcaution

The sole workflow was fully analyzed with no audit findings, no untrusted checkouts, and no script injection. However, all 9 action references are unpinned, leaving the CI supply chain less reproducible.