kanekescom/laravel-helperia

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is a supply-chain and installation-behavior consideration, although the signal does not show that the script is harmful.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful maintenance warning even though releases and pull requests show other recent activity.

Repo popularitycaution

The repository has no stars and only two forks and watchers. This provides little independent adoption evidence, but popularity is supporting evidence and does not outweigh the maintenance signals.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear; this is a transparency gap, not evidence of abandonment by itself.

Workflow auditcaution

All five workflows were analyzed, but 9 of 12 action references are unpinned, three workflows grant top-level write access, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no reported untrusted checkout or script-injection sink, so these issues are workflow hygiene concerns rather than a severe standalone risk.