jeffersongoncalves/filament-gtm

Lifecycle scriptscaution

The package runs a post-autoload-dump Composer lifecycle script. This is a mild supply-chain surface increase, but no evidence here shows that the script is unsafe.

Maintainerscaution

Only one registry publishing account is listed, which limits publishing redundancy. Repository activity from three contributors provides some compensating maintenance capacity.

Project backingcaution

The registry namespace and repository are owned by the same individual account, so there is no organizational handoff capacity shown; however, recent activity includes three contributors.

Workflow auditcaution

All four workflows were analyzed, all 10 action references are pinned, and no untrusted checkout or script-injection paths were found. The high-confidence bot-conditions finding in Dependabot auto-merge is a workflow hygiene concern, while top-level write permissions on two workflows are only a mild caution without an untrusted trigger.