concept7/laravel-nbo

Workflow auditdanger

All 12 action references are unpinned, and a high-confidence bot-conditions finding reports spoofable actor context in the Dependabot auto-merge workflow. Three workflows also grant top-level write access, increasing automation exposure.

Maintainerscaution

Only one registry account has publish access, creating release continuity risk, though the repository is backed by an organization.

Release historycaution

The package is only 122 days old with two releases and a median interval of about 79 days, so its maintenance track record is still limited.

Repo bus factorcaution

One contributor made 100% of the two recent commits. Organization backing provides some handoff capacity, but no second active contributor is shown.

Repo commit activitycaution

Only two commits from one active maintainer were recorded in the last three months, so observed maintenance capacity is thin.