domain/laravel-domain-generator

Dangerous workflowscaution

One of 11 workflows uses pull_request_target, which deserves review because that trigger can expose elevated workflow privileges. No untrusted checkout or script-injection patterns were detected, limiting the concern.

Maintainerscaution

Only one account has registry publishing access, which is a resilience concern for a user-owned project. However, the linked repository shows two active contributors, partially compensating for the narrow registry access list.

Package scaffoldingcaution

The artifact has a substantial README and changelog, and the repository uses GitHub Releases, but neither the package nor repository contains tests. For a generator that creates application code, this leaves behavior insufficiently validated.

Project backingcaution

The package is backed by a user-owned repository rather than an organization, so the small maintainer and contributor base represents genuine continuity risk.

Release historycaution

The package is only 28 days old, with 28 releases and a median interval of about 16 minutes, indicating active work but very limited maturity and an unusually fast release cadence.