byrcsc/laravel-whitelabel

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script, adding execution during dependency installation. This is a review concern, although the signal does not show malicious behavior or an unsafe script.

Maintainerscaution

Only one registry account has publishing access. The repository is organization-owned, which provides some backing, but the registry publishing base remains concentrated.

Release historycaution

The package is only 34 days old and has one release, so there is little evidence yet about long-term maintenance or release stability.

Repo bus factorcaution

One contributor made all 18 recent commits. Organization ownership offers some handoff capacity, but no second active contributor is evidenced, leaving maintenance dependent on one person.

Workflow auditcaution

All three workflows were analyzed, but all 13 action references are unpinned, one workflow grants top-level write permissions, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so these are workflow hygiene concerns rather than a standalone severe risk.