laravel-notification-channels/fcm

Name lookalikedanger

The package is reported to borrow the identity of laravel/slack-notification-channel, which has substantially more monthly downloads; this is a serious supply-chain and consumer-confusion concern despite zero artifact overlap.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months, reducing evidence of ongoing maintenance even though a release was published during the broader release history.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected; this is a modest hygiene gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, leaving reporting and response expectations undocumented; this is a transparency gap but not a release-blocking finding by itself.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, both action references are unpinned, which is a minor reproducibility and workflow-supply-chain gap.