legionhq/laravel-payrex

Lifecycle scriptscaution

The package runs a post-autoload-dump install lifecycle script. This is a supply-chain exposure that is not shown to be harmful here, so it warrants limited caution.

Project backingcaution

The source repository is owned by an individual rather than an organization, so the single registry maintainer offers limited visible organizational backing.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a meaningful maintenance warning for a young package.

Workflow auditcaution

All 17 analyzed action references are unpinned, and three workflows grant top-level write permissions. The audit also found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow; there is no untrusted checkout or script injection, so this is a substantial hygiene caution rather than a standalone critical risk.