devsarfo/laraphone

Dangerous workflowscaution

Five workflows were analyzed without untrusted checkouts or script injection, but one uses pull_request_target for automated Dependabot merging, which warrants care because that trigger runs with elevated trust.

Lifecycle scriptscaution

A post-autoload-dump install-time script runs during Composer installation, adding execution surface for consumers, although this is not by itself evidence of poor maintenance.

Project backingcaution

The registry namespace and repository owner match, but the owner is an individual account rather than an organization, so the project appears to rely on a single-owner backing model.

Release historycaution

The package is about 17 months old but has only three releases, with one release in the last 12 months and a median interval of about 193 days, indicating a relatively slow release cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months, a meaningful sign that maintenance may be slowing despite the more recent push recorded elsewhere.