eslamddd/skeloton-package

Release historydanger

The package has had 3 releases since December 2023 and none in the last 12 months; the latest release is nearly three years old, indicating likely abandonment.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months; combined with no registry releases in the last year, this is strong evidence of stalled maintenance.

Workflow auditdanger

All 12 action references are unpinned, three workflows grant top-level write permissions, and a high-confidence bot-condition finding affects the Dependabot auto-merge workflow. No untrusted checkout or script injection was found, but the combined workflow hygiene is a real supply-chain concern.

Dependency profilecaution

Nine runtime dependencies, including Laravel, Livewire, Passport, and repository packages, create a relatively broad dependency surface for a package with limited recent release activity.

Lifecycle scriptscaution

The package runs a post-autoload-dump script during installation. This is a meaningful execution surface, but the signal provides no evidence that the script is unsafe or unusually broad.