doctrine/data-fixtures

Name lookalikedanger

The package is flagged as borrowing the identity of doctrine/lexer, with borrows_lookalike_identity true and no self-described fork or integration evidence. Although artifact overlap is 0.0, this creates a serious risk that consumers intended to install the lookalike package.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months. This is a maintenance warning, although the recent release history and three merged pull requests provide some compensating evidence.

Workflow auditcaution

All six workflows were analyzed without failures and have no untrusted checkouts, script injection, or top-level write permissions. However, all 12 action references are unpinned, and the audit found a high-confidence, high-severity unpinned container image, which weakens build reproducibility and workflow supply-chain hygiene.