mrethical/laravel-clickhouse-extended

Dangerous workflowscaution

Five workflows were analyzed with no untrusted checkouts or script injection, but one uses pull-request-target, which requires careful review because it can run with elevated repository context.

Lifecycle scriptscaution

A post-autoload-dump install-time script runs during dependency installation, adding supply-chain and installation complexity even though no other evidence indicates harmful behavior.

Project backingcaution

The registry namespace and repository owner match, but the owner is an individual rather than an organization; this is consistent ownership, though it indicates a relatively narrow backing base.

Release historycaution

This package is 139 days old and has only one release, so there is little release history to demonstrate sustained maintenance or compatibility stability.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months, which is a meaningful maintenance concern for a package with only one release.