masrodjie/laravel-whatspie

Workflow auditdanger

All 12 action references are unpinned, and three workflows grant top-level write permissions. More seriously, the high-confidence bot-conditions finding in the Dependabot auto-merge workflow indicates a potentially spoofable actor check; no untrusted checkout or script-injection sink was found.

Lifecycle scriptscaution

The package uses a post-autoload-dump lifecycle script. This adds install-time behavior and deserves awareness, but the signal alone does not show that the script is unsafe or unusually broad.

Project backingcaution

The repository and registry are owned by the same individual account rather than an organization. That is consistent ownership, but it also means the project has no observed organizational backing to broaden maintenance capacity.

Release historycaution

Only one release has been published, with no established release cadence yet. At 166 days old, this indicates an early-stage project rather than proven long-term maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months. With only one release, this is meaningful evidence of currently weak maintenance momentum.