andriichuk/laravel-atompark-sms-channel

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script, which adds execution during installation and warrants some supply-chain caution, although one Composer lifecycle hook is not severe by itself.

Repo commit activitycaution

The repository had no commits and no active maintainers in the past three months, a meaningful maintenance concern despite the recent registry releases and latest repository push.

Security policycaution

No security policy is present, leaving vulnerability reporting and response expectations undocumented for a package used in application messaging.

Version stabilitycaution

Version 0.2.0 is a non-prerelease but remains below a stable 1.0 release, so compatibility expectations are less established.

Workflow auditcaution

All 12 analyzed action references are unpinned, and the audit found a high-confidence bot-conditions issue; three workflows also grant top-level write access. No untrusted checkout or script-injection sink was found, so this is workflow hygiene risk rather than a severe standalone failure.