backstage/laravel-users

Lifecycle scriptscaution

The package defines a post-autoload-dump lifecycle script. This deserves awareness because installation executes package code, but the signal alone does not show unsafe behavior.

Release historycaution

The package published 187 releases in 12 months, with a median interval of about 48 minutes. This shows strong publishing activity but an unusually noisy cadence that reduces release transparency.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. That is a meaningful maintenance concern, even though registry releases continued during the period.

Security policycaution

The repository has no SECURITY.md or other declared security policy. This weakens vulnerability-reporting transparency for a package handling authentication and permissions.

Workflow auditcaution

All 12 action references are unpinned, three workflows grant top-level write permissions, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a hygiene and workflow-safety concern rather than a severe standalone risk.