danestves/laravel-polar

Dangerous workflowscaution

One of five workflows uses pull_request_target, which can warrant review, but the analysis found no untrusted checkout or script-injection patterns.

Lifecycle scriptscaution

A post-autoload-dump install-time script is present. This is a caution for installation transparency because it runs automatically, although the signal does not show that the script is malicious or unusually risky.

Maintainerscaution

Only one registry account has publish access, which is a limited release-control base; the repository nevertheless shows two active contributors, partially reducing the concern.

Project backingcaution

The registry namespace and repository are owned by the same individual, confirming ownership alignment, though there is no organizational backing to cushion single-owner risk.

Repo bus factorcaution

The top contributor made 80% of the recent commits, creating some concentration risk, but a second contributor supplied the remaining 20% and remained active.