artisan-toolbox/qztray

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script, adding execution during dependency installation; the available evidence does not show it is malicious, but it is an additional supply-chain surface.

Maintainerscaution

Only one registry account has publish access, which is a concentration risk, although registry access does not measure actual maintenance capacity.

Release historycaution

The package is extremely new: it is 0 days old with only 2 releases and a median interval of about 2.7 hours, so long-term maintenance and release stability are unproven.

Repo bus factorcaution

All 10 recent commits came from one contributor, creating a thin individual maintenance base; organization ownership provides some handoff capacity but does not remove the concentration risk.

Workflow auditcaution

All workflows were analyzed successfully, use read-only permissions, and have no audit findings; 3 of 7 action references are unpinned, a modest reproducibility and supply-chain hygiene gap.