johnpaulmedina/laravel-usps

Release historycaution

The package is only 176 days old and all 12 releases occurred within a very short burst, with a median interval of about 7 minutes; this shows active initial publishing but little long-term release history.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months, which is a meaningful maintenance-continuity concern for a young package.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations and response procedures unclear.

Workflow auditcaution

All 28 action references are unpinned and seven workflows grant top-level write permissions, while the audit found high-confidence template-injection patterns and one script-injection finding. No untrusted checkout or privileged trigger was reported, so these are workflow-hardening concerns rather than a standalone severe verdict.