Package Health/khomerikik/laravel-russian-roulette

khomerikik/laravel-russian-roulette

Risky to adopt: the package has had no registry release in about two years and eight months, no recent repository commits, and a prior scan flagged this release as a supply-chain risk. It has a real repository, tests, licensing, and release notes, but those positives do not offset the stale maintenance and workflow concerns.

Latest v0.0.6

Packagist

30%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has made six releases, but none in the last 12 months, and the latest release is about two years and eight months old. This is a substantial maintenance and abandonment concern.

Repo commit activity

The repository recorded no commits and no active maintainers during the last three months, which supports the broader evidence of stalled maintenance.

Dangerous workflows

One workflow uses pull_request_target, a sensitive workflow trigger. No untrusted checkout or script injection was detected, which limits the concern but does not remove the elevated workflow risk.

Lifecycle scripts

The package runs a post-autoload-dump installation lifecycle script. Install-time execution adds supply-chain exposure, although this signal alone does not show that the script is harmful.

Maintainers

Only one registry account has publish access, creating a limited publishing base. The linked personal repository provides some ownership context, but no recent activity compensates for the narrow base.