kanekescom/laravel-siasn-referensi

Lifecycle scriptscaution

A post-autoload-dump install-time script runs during Composer installation. This adds execution surface and deserves review, although the signal does not show that the script is malicious or unusually risky.

Release historycaution

The package has 30 releases, but none in the last 12 months and the latest registry release was nearly two years ago, which raises maintenance and abandonment concerns.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months, consistent with the absence of recent registry releases and indicating limited current maintenance.

Security policycaution

The repository has no published security policy. This is a transparency and reporting gap, though it is a secondary concern for an otherwise identified and licensed project.

Workflow auditcaution

All 12 analyzed action references are unpinned, and three workflows grant top-level write permissions. The high-confidence bot-condition finding also indicates a potentially spoofable actor check; no untrusted checkout or script-injection sink was found, so this is workflow hygiene risk rather than a severe standalone issue.