andriichuk/laravel-http-client-logger

Dangerous workflowscaution

One of six workflows uses pull_request_target for Dependabot auto-merge. No untrusted checkouts or script-injection patterns were detected, so this is a contained workflow-risk concern.

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is a relevant execution consideration for Composer consumers, although the signal does not show that the script is malicious or unusually complex.

Project backingcaution

The registry namespace and repository are owned by the same individual rather than an organization, so continuity depends substantially on that maintainer.

Release historycaution

Six releases were published in the first 187 days, with the latest release only about 6 weeks before collection, showing continued publication but a still-short track record.

Repo commit activitycaution

There were 2 commits in the last 3 months from 2 active maintainers, including a recent repository push, indicating activity but a light maintenance cadence.