grantholle/scru128-laravel

Dangerous workflowscaution

One of five workflows uses pull_request_target for Dependabot auto-merge. No untrusted checkouts or script-injection patterns were detected, so the workflow setup presents limited but real review risk.

Lifecycle scriptscaution

A post-autoload-dump install-time script is present. This is a meaningful execution point for consumers and warrants review, though the signal alone does not establish that the script is unsafe.

Maintainerscaution

One registry publishing account creates a limited bus for releases, but the linked repository is owned by the same individual and the package is not organization-backed, so this remains a modest resilience concern.

Project backingcaution

The registry namespace and repository owner match, but both identify an individual rather than an organization, so the package has limited visible institutional backing.

Release historycaution

The package is less than three hours old and has only two releases, so there is not yet enough history to demonstrate sustained maintenance or release discipline.