chrisdicarlo/laravel-config-checker

Dangerous workflowscaution

One workflow uses pull_request_target for Dependabot auto-merging. No untrusted checkouts or script-injection patterns were detected, but this privileged workflow warrants caution because it operates in a sensitive pull-request context.

Lifecycle scriptscaution

The package runs a post-autoload-dump Composer lifecycle script. This is an avoidable installation-time execution surface, although the signal does not show that the script is malicious or unusually complex.

Maintainerscaution

Only one registry account has publish access. That is a modest resilience concern for a user-owned project, though repository activity and matching ownership provide some compensating context.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is the clearest maintenance concern, although the recent push and release history show the project has not been abandoned for years.

Repo issue activitycaution

There are no open issues and four open pull requests, but no issues or pull requests were newly created or merged in the last month, indicating limited current interaction.