damianulan/laravel-form-forge

Lifecycle scriptscaution

A post-update-cmd lifecycle script is declared, adding some execution during dependency updates. The signal does not show a dangerous command, so this is a limited operational concern rather than a severe dependency risk.

Maintainerscaution

Only one registry publishing maintainer is listed, which creates a thin publishing base. The matching user-owned repository and recent release history show some continuity, but do not remove the bus-factor concern.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This recent inactivity is concerning, although the package had a strong release cadence over the preceding year.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools are reported. This is a modest transparency and maintenance gap for a package that processes application form data.

Security policycaution

No repository security policy is present. That weakens vulnerability-reporting transparency, though it is not evidence that the package is unsafe.