aymanalhattami/filament-context-menu

Lifecycle scriptscaution

A post-autoload-dump install lifecycle script is present, so installation performs package-specific execution. This is a modest supply-chain and reproducibility consideration, though the signal does not show malicious behavior.

Project backingcaution

The package and repository are owned by the same individual account rather than an organization. This is consistent ownership, but it indicates limited institutional backing for continuity.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although the package released recently, this indicates currently slowed development activity.

Workflow auditcaution

All five workflows were analyzed, but all 12 action references are unpinned, three workflows grant top-level write access, and a high-confidence bot-conditions finding may allow actor context to be spoofed. The pull_request_target workflow has no untrusted checkout or script-injection finding, limiting the severity, but the combined workflow hygiene is a real concern.