laravel-json-api/encoder-neomerx

Name lookalikedanger

The package is marked as borrowing the identity of the much more established laravel/vapor-core, with borrows_lookalike_identity true. Although artifact overlap is 0.0 and the README does not identify it as that project, this creates a serious risk that consumers wanted the lookalike instead.

Release historycaution

The package has existed for about 5 years and contains 17 releases, but only one release appeared in the last 12 months. That indicates a slow maintenance cadence, partly offset by the latest release being recent.

Repo commit activitycaution

The repository recorded no commits and no active maintainers during the last 3 months. This is a meaningful maintenance concern despite the recent registry release and repository push.

Security policycaution

The linked repository has no security policy, reducing transparency for reporting and handling vulnerabilities. The package is small and otherwise has a matching repository, tests, and a changelog, which limits but does not remove the gap.

Workflow auditcaution

The sole workflow was fully analyzed with no untrusted checkouts, injection findings, or reported audit findings, but all 3 action references are unpinned. That leaves avoidable build reproducibility and action-supply-chain exposure.