neocode/laravel-app-pairing

Lifecycle scriptscaution

The package uses a post-autoload-dump install-time script, which warrants review because it runs during installation, although the signal provides no evidence of dangerous behavior by itself.

Project backingcaution

The registry namespace is linked to the same user-owned repository owner, providing consistent ownership evidence. It is not organization-backed, so the small maintainer base offers less institutional continuity.

Release historycaution

The package is only 26 days old and all three releases occurred within roughly one hour, so long-term maintenance and release stability are not yet demonstrated. The recent release activity is still a modest positive rather than evidence of abandonment.

Repo popularitycaution

The repository has zero stars, forks, and watchers. Given the package's 26-day age, this is weak evidence of limited adoption rather than a severe health problem.

Token permissionscaution

Both workflows declare top-level permissions; one is read-only and one requests write access for update-changelog.yml. The explicit permissions improve transparency, though write access is a small workflow-hardening concern.