jeffersongoncalves/laravel-matomo

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This adds supply-chain and installation complexity, though the signal provides no evidence that the script is malicious or unusually broad.

Maintainerscaution

Only one registry account has publish access. Because the repository is user-owned rather than organization-owned, this indicates a concentrated publishing responsibility, although repository activity shows another active contributor.

Project backingcaution

The package and repository are owned by the same individual account, so the source linkage is consistent, but there is no organization backing to broaden maintenance capacity.

Repo bus factorcaution

Two contributors were active in the last 3 months, with the top contributor responsible for about 61% of commits. This is somewhat concentrated but not dependent on a single contributor.

Workflow auditcaution

All 5 workflows were analyzed, and all 12 action references are pinned with no untrusted checkout or script-injection findings. However, a high-confidence bot-conditions finding reports that actor context may be spoofable in the Dependabot auto-merge workflow, which is a real workflow-integrity concern.