alhelwany/laravel-ecash

Workflow auditdanger

All four workflows were analyzed, but the audit found a high-confidence bot-conditions issue and all nine action references are unpinned. The pull_request_target trigger has no untrusted checkout or script-injection sink, so it is not independently dangerous.

Lifecycle scriptscaution

A post-autoload-dump install script is present. This is a potentially consequential install-time action, but the supplied signal gives no evidence that it is unsafe or unusually broad.

Maintainerscaution

One registry maintainer means limited publishing redundancy, though the linked repository is owned by the same individual, so this is a modest resilience concern rather than evidence of abandonment by itself.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single registry maintainer reflects limited project backing.

Release historycaution

The latest registry release was published in November 2024, with no releases in the last 12 months, indicating a prolonged release gap for a payment integration.