lauroguedes/laravel-astro-landing

Lifecycle scriptscaution

The package runs a post-autoload-dump install lifecycle script. This is a meaningful installation-time behavior that deserves review, though it is not by itself evidence of an unsafe release.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational backing shown to compensate for the package's single registry maintainer and very short history.

Release historycaution

The package is only 0 days old with 4 releases, all within roughly 2 hours; this shows active initial publishing but provides no evidence of an established maintenance record.

Repo commit activitycaution

No commits or active maintainers were observed in the last 3 months. Because the repository is only 0 days old, this mainly indicates that long-term maintenance capacity is unproven rather than confirmed abandonment.

Workflow auditcaution

All 4 workflows were analyzed with no untrusted checkouts, script injection, or audit findings. However, all 9 action references are unpinned and one workflow grants top-level write permission, creating workflow supply-chain and permission-hygiene concerns without an observed untrusted sink.