gts-meghni/laravel-essentials-kit

Lifecycle scriptscaution

A post-autoload-dump script runs during installation, so installation has executable package behavior rather than being purely passive. That is a modest supply-chain and installation-complexity concern, with no provided evidence that the script is unsafe.

Project backingcaution

The repository is owned by a personal GitHub account rather than an organization, so maintenance depends on a small individual-backed project. The two active contributors partly offset that limitation.

Release historycaution

The package is only 36 days old with two releases, although the median interval is about two days and the latest release is recent. This supports active early development but leaves long-term maintenance unproven.

Workflow auditcaution

Both workflows were analyzed successfully with no audit findings, all five action references are pinned, and no untrusted checkout or script-injection paths were found. One workflow grants top-level write permissions, which is a mild hygiene concern but not severe without an untrusted trigger.