njoguamos/laravel-pesapal

Lifecycle scriptscaution

The package uses a post-autoload-dump install-time script. This deserves review before adoption because installation behavior is not entirely passive, although no separate workflow-risk evidence indicates a severe concern.

Project backingcaution

The registry namespace and repository are owned by the same individual account, so the package has direct ownership alignment but no organization-level maintenance backing.

Repo bus factorcaution

All recent commits come from one contributor, so an interruption to that contributor could leave maintenance unsupported; the individual-owned project backing does not provide an organizational handoff.

Repo commit activitycaution

Only one commit was made in the last 3 months by one active maintainer, which is a meaningful sign of limited recent development capacity despite the strong release history.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear; this is a transparency gap rather than evidence that the package is unsafe.