Package Health/eighteen73/laravel-tokens

eighteen73/laravel-tokens

This is a usable, transparently packaged release with an MIT license, stable versioning, regular release activity over its 327-day history, a matching repository, repository tests, changelog, build tooling, and no deprecation or archive indicators. The main concerns are its relatively young project age, only three commits from one active contributor in the last three months, absent security policy, and several workflows with broad or unspecified token permissions; organization ownership provides some maintenance backing but does not fully remove the concentration risk. Overall, it appears reasonable to depend on, with normal diligence around future maintenance and CI security.

Latest 1.0.7

Packagist

70%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Dangerous workflows

One of five workflows uses pull_request_target, which is a higher-risk workflow context, although no untrusted checkout or script-injection pattern was detected.

Lifecycle scripts

A post-autoload-dump script is present, which is a relevant install-time execution surface, but this signal alone does not establish an unhealthy release or unusual package behavior.

Maintainers

Only one registry account has publish access, which is a modest publishing-resilience concern; the organization-owned repository provides some compensating project backing, but registry publication still depends on one account.

Repo bus factor

All three recent commits came from one contributor, creating concentration risk; organization ownership offers some handoff potential, but no second active contributor is shown.

Repo commit activity

Three commits from one active maintainer in the last three months indicate ongoing work, but the low volume limits evidence of sustained maintenance capacity.