chrishardie/laravel-synced-ip-allowlist

Lifecycle scriptscaution

A post-autoload-dump install-time script runs during Composer operations. This adds execution during installation, though the signal does not show that the script is unsafe or unusually broad.

Maintainerscaution

Only one account has registry publish access. This is a genuine continuity concern for a user-owned project, although repository activity shows that the same maintainer is currently active.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the concentrated maintainer and contributor activity is not offset by visible organizational backing.

Release historycaution

The package is 473 days old with only three releases, two in the last 12 months, and a median release interval of about 195 days. That is a slow but not abandoned cadence, especially given the release as recently as June 25, 2026.

Repo bus factorcaution

All two recent commits came from one contributor, leaving no demonstrated backup maintainer if that person becomes unavailable.