backstage/laravel-mails

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is a meaningful installation behavior to review, although the signal alone does not show that it is unsafe or unusually broad.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. That is a real maintenance concern, especially because the registry shows very frequent releases rather than corresponding recent source activity.

Security policycaution

The repository has no security policy. This is a transparency gap for a package that handles mail events and webhooks, though it does not by itself show abandonment.

Workflow auditcaution

All five workflows were analyzed, but the audit found a high-confidence bot-conditions issue in the Dependabot workflow and all 12 action references are unpinned. There is no untrusted checkout or script injection, which limits the severity.