alwayscurious/laravel-project-devtool

Repo commit activitydanger

The repository recorded no commits and no active maintainers in the last 3 months, despite the package being only about 3 months old. That is a meaningful sign of weak ongoing maintenance.

Lifecycle scriptscaution

The package runs a post-autoload-dump lifecycle script during installation. Install-time execution deserves caution because it can affect consumers before normal use, though this signal alone does not show harmful behavior.

Release historycaution

This is a young package, about 3 months old, with only two releases published within a few hours. That provides limited evidence of a sustained maintenance cadence.

Security policycaution

No security policy was found in the repository, leaving vulnerability-reporting expectations unclear. This is a transparency gap rather than evidence that the package is unsafe.

Workflow auditcaution

All 12 analyzed action references are unpinned, and three of five workflows grant top-level write permissions. The audit found no high-confidence dangerous findings, but the pinning and permission hygiene still reduce build reproducibility and least-privilege assurance.