mk-josias/laravel-distributable-modules-starter

Lifecycle scriptscaution

The package runs four Composer lifecycle scripts, including post-create-project-cmd. Such setup behavior is expected for a create-project starter, but multiple install and update hooks increase the amount of code executed automatically.

Project backingcaution

The repository owner is a user account rather than an organization, and the available ownership data shows no broader project backing. This reinforces the single-maintainer risk but does not indicate abandonment by itself.

Release historycaution

This package is extremely new: all five releases were published within roughly four hours, so there is not yet enough history to demonstrate sustained maintenance or release stability.

Repo bus factorcaution

One contributor made all 38 commits in the last three months, leaving maintenance highly concentrated in a single person. The repository owner is an individual, so there is no organizational backing shown to offset that concentration.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. That is a process gap for a package that installs application code and dependencies, though it is not evidence of malicious behavior.