momenoor/laravel-msgraph-mailer

Repo commit activitydanger

There were zero commits and zero active maintainers in the last three months, which is a material warning for a package with only one release.

Workflow auditdanger

All five workflows were analyzed, but one high-confidence bot-condition finding indicates spoofable actor checks. All 12 action references are unpinned, and three workflows grant top-level write access, creating notable workflow hygiene risk even without an untrusted checkout or script-injection finding.

Dependency profilecaution

The package has nine runtime dependencies, including framework, mail, Graph API, and HTTP components; this is a meaningful dependency surface but consistent with its integration role.

Lifecycle scriptscaution

A post-autoload-dump install script adds some supply-chain and installation complexity, though one standard Composer lifecycle script is not severe on its own.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry maintainer does not have organizational backing to compensate for the thin maintenance history.