bernskiold/laravel-campaign-monitor

Dangerous workflowscaution

One of three workflows uses pull_request_target, which requires care because it can run with elevated repository context. No untrusted checkout or script-injection patterns were detected, limiting the concern.

Lifecycle scriptscaution

The package defines a post-autoload-dump install-time script, which adds execution during installation. No evidence here shows that the script is dangerous, so this is a limited supply-chain hygiene concern rather than a severe risk.

Maintainerscaution

Only one account has registry publish access, which creates a limited publishing and continuity base. The organization-owned repository provides some compensation, but it does not remove the single-publisher concentration.

Release historycaution

The package is 618 days old but has only three releases, with two releases in the last 12 months and a median interval of about 309 days. That is a slow cadence, though not by itself evidence of abandonment.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, a meaningful sign that ongoing maintenance may be intermittent. The recent release and merged pull request show some activity but do not fully offset the quiet commit period.