baspa/laravel-timezones

Lifecycle scriptscaution

The package uses a post-autoload-dump install-time script. This deserves awareness because lifecycle code runs during installation, but the indicator provides no evidence that the script is unsafe.

Project backingcaution

The repository is owned by a personal account rather than an organization, so the one-person contributor concentration is not offset by visible organizational backing.

Repo bus factorcaution

All recent commits came from one contributor, Baspa, giving the project a single-person maintenance base with no observed handoff capacity.

Repo commit activitycaution

The repository recorded one commit in the last 3 months from one active maintainer. Recent activity is present, but the low volume makes ongoing maintenance capacity a concern.

Workflow auditcaution

All five workflows were analyzed, use read-only permissions, and pin all 15 action references. However, the auditor reported a high-confidence bot-conditions finding in the Dependabot auto-merge workflow because actor context may be spoofable.