nativephp/desktop
NativePHP for Desktop
88%
Total Score
100
100
100
70
Health Score Breakdown
One workflow uses pull_request_target for automated Dependabot merging. This is a sensitive workflow pattern, but no untrusted checkouts or script-injection findings were detected across the analyzed workflows.
The package runs a post-autoload-dump script during installation. This is a relevant install-time behavior that deserves review, although it is not severe by itself for a framework-integrated package.
Four workflows omit top-level permissions and three grant top-level write access; no workflow declares read-only permissions, leaving avoidable CI token exposure despite the repository's other security tooling.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Marcel Pociot |
| Simon Hamp |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 laravel/prompts Version ^0.1.1|^0.2|^0.3 | — | — |
nativephp/php-bin Version ^1.0 | — | — |
symfony/filesystem Version ^6.4|^7.2|^8.0 | — | — |
illuminate/contracts Version ^10.0|^11.0|^12.0|^13.0 | — | — |
spatie/laravel-package-tools Version ^1.16.4 | — | — |
Weekly Downloads
Info
- Last Published
- 26 days ago
- Created
- 12 months ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.