nettsite/nettmail-laravel

Dangerous workflowscaution

One workflow uses pull_request_target for Dependabot auto-merge. No untrusted checkout or script injection was detected, but this workflow type warrants extra review because it runs with elevated repository context.

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is not inherently unsafe, but install-time execution adds operational risk compared with a package with no lifecycle scripts.

Release historycaution

There are six releases, but they were concentrated within roughly two days and the latest release was about three months ago, giving limited evidence of sustained release maintenance.

Repo commit activitycaution

The repository recorded only two commits in the last three months, although two maintainers contributed equally; this suggests limited recent development rather than a single-maintainer bottleneck.

Repo issue activitycaution

There are two open pull requests, one new in the last month, but none merged and no issue activity in that period, providing weak evidence of ongoing project responsiveness.