nyamort/laravel-anonymizer

Dangerous workflowscaution

One workflow uses pull_request_target for Dependabot auto-merge, which warrants review because that trigger can grant elevated repository context. No untrusted checkout or script-injection pattern was detected, which limits the concern.

Lifecycle scriptscaution

A post-autoload-dump script runs during installation, which adds some supply-chain exposure, but this is a conventional Composer lifecycle hook and no additional dangerous behavior is shown here.

Package scaffoldingcaution

The published artifact includes a README and changelog, and the repository contains tests and a changelog. The missing tests in the artifact is normal packaging practice, but the README's unfinished description and template text reduce consumer transparency.

Project backingcaution

The registry namespace and repository are owned by the same individual account, which provides consistent ownership but not the redundancy of an organization-backed project.

Release historycaution

The package is 287 days old but has only two releases, with a median interval of about 166 days. That establishes limited release history and leaves maintenance maturity less proven.