noopstudios/laravel-revenue-cat

Lifecycle scriptscaution

The package runs a post-autoload-dump install lifecycle script. This adds some installation complexity, but the signal alone does not show that the script is unsafe or unusually risky.

Release historycaution

The package is about 398 days old with eight releases, but only one release in the last 12 months. The recent release provides some evidence of continued publishing, while the sparse cadence limits confidence in active maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although a recent release and push show some activity, the current development silence is a maintenance concern.

Security policycaution

The repository has no security policy. For a package handling subscription data and webhook signatures, this is a transparency gap, though it is not evidence of abandonment by itself.

Workflow auditcaution

All 12 analyzed action references are unpinned, and three workflows grant top-level write permissions. The audit also found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow; there was no untrusted checkout or script injection, so this is a significant hygiene concern rather than a standalone severe risk.