byrcsc/laravel-cartographer

Dangerous workflowscaution

One of three workflows uses pull_request_target. No untrusted checkout or script injection was detected, so the workflow profile is a limited caution rather than a severe risk.

Lifecycle scriptscaution

A post-autoload-dump install script is present. This is a point to review because it runs during installation, but the signal provides no evidence that it is unsafe or unusually broad.

Maintainerscaution

Only one registry account has publish access. That is a concern for release continuity, but it is partly offset by the repository being owned by an organization.

Release historycaution

The package is only 44 days old with two releases, though the releases arrived about 3 days apart and show active early development. Its short history leaves long-term maintenance unproven.

Repo bus factorcaution

One contributor made all 21 commits in the last 3 months, creating a low bus factor. Organization ownership provides some handoff capacity but does not show that another contributor is active.