digit-soft/laravel-ppm-bridge

Release historydanger

This package has had only one release, on October 21, 2020, with none in the last six years. That is strong evidence of abandonment for a dependency, although it is not registry-deprecated.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap. The repository is not archived, but there is no observed recent maintenance.

Repo toolingcaution

Composer is used as the build tool, which fits the package, but no security-scanning tool was detected. This modestly reduces assurance because there is no automated security-checking evidence.

Security policycaution

The linked repository has no security policy, leaving no documented channel or process for reporting vulnerabilities. This is a transparency gap, though the package is small and no other security-process evidence was provided.

Workflow auditcaution

The only workflow was fully analyzed, but both action references are unpinned, and it contains high-confidence template-injection and archived-action findings. No untrusted checkout or script-injection path was reported, so these remain workflow-hygiene concerns rather than a standalone severe risk.