mmstewart/laravel-x-ray
The project is very new, with only two releases and all recent commits from one contributor. It has tests, a changelog, a license, security policy, active recent commits, and no deprecation or archive warning, but its workflows use broad write permissions and all actions are unpinned.
68%
Total Score
67
94
75
Health Score Breakdown
A post-autoload-dump install-time script runs during Composer installation, adding execution during dependency setup and therefore some supply-chain exposure.
The repository is owned by an individual account rather than an organization, so the single-contributor concentration provides no visible organizational handoff cushion.
The package is less than one day old and has only two releases, so its maintenance history and release reliability are not yet established.
All 15 recent commits came from one contributor, leaving maintenance dependent on a single person.
All workflows were analyzed with no reported audit findings, but all nine action references are unpinned and three workflows grant top-level write permissions. The pull_request_target workflow has no untrusted checkout or script-injection sink, so these remain hygiene concerns rather than a severe risk.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 mmstewart |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 composer/semver Version ^3.0 | — | — |
illuminate/contracts Version ^11.0||^12.0||^13.0 | — | — |
spatie/laravel-package-tools Version ^1.16 | — | — |
Weekly Downloads
Info
- Last Published
- 13 hours ago
- Created
- 13 hours ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.