Package Health/grantholle/scru64-laravel

grantholle/scru64-laravel

Usable with caveats: this is a well-documented, licensed package with repository tests and matching source, but it is only hours old and has not yet demonstrated sustained maintenance. Review its install-time script and GitHub Actions permissions before adopting it broadly.

Latest 1.0.1

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Dangerous workflows

One of five workflows uses pull_request_target for Dependabot auto-merge. No untrusted checkout or script-injection pattern was detected, but this workflow type warrants review because it can run with elevated repository context.

Lifecycle scripts

The package runs a post-autoload-dump install-time script. This is a meaningful execution point for consumers, although the signal does not show additional suspicious script behavior.

Maintainers

One registry maintainer is consistent with this user-owned project, but it also indicates a limited individual maintainer base if the project needs continuity.

Release history

The package is only about two hours old and has two releases, with a median interval of about 6.6 minutes. That is too little history to establish maintenance reliability, despite the recent activity.

Repo commit activity

The repository records zero commits and zero active maintainers over the last three months, but the package is only about two hours old, so this is an immature history rather than evidence of a collapsed project.