kimulisiraj/sms-speeda-mobile-laravel

Maintainerscaution

One registry maintainer is consistent with the repository being owned by an individual, but it leaves little publishing redundancy if that maintainer becomes unavailable.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry maintainer does not have organizational backing to compensate for a thin maintainer base.

Release historycaution

The package has existed since February 2022 and has four releases, but only one release appeared in the last 12 months with a median interval of about 238 days. This indicates a slow release cadence rather than active ongoing delivery.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. Combined with the slow release cadence, this is evidence of currently limited maintenance activity.

Workflow auditcaution

All four workflows were analyzed, but all nine action references are unpinned, and a high-confidence bot-conditions finding reports spoofable actor context in the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a meaningful hygiene concern rather than a severe standalone risk.