jeffersongoncalves/laravel-crisp

Lifecycle scriptscaution

Composer runs a post-autoload-dump install-time script. Lifecycle scripts add execution during installation, so this is a supply-chain and reproducibility consideration even though no harmful behavior is shown here.

Project backingcaution

The repository is owned by an individual user rather than an organization. That is not inherently unhealthy, but it provides less visible backing than an established organizational project and reinforces the limited maintenance history.

Release historycaution

The package is less than one day old and has only two releases, with roughly 18 hours between them. This is too little history to establish long-term maintenance reliability, although the recent release activity is consistent with a newly published package.

Repo commit activitycaution

The repository reports zero commits and zero active maintainers in the last three months. Because the package itself is less than one day old and was recently pushed, this does not yet demonstrate abandonment, but it leaves maintenance capacity unproven.

Workflow auditcaution

All five workflows were analyzed, all 12 action references are pinned, and no untrusted checkouts or script injections were found. However, the audit reports a high-confidence bot-conditions finding in the Dependabot auto-merge workflow, where actor context may be spoofable, which warrants caution.