oi-lab/oi-laravel-ts

Lifecycle scriptscaution

The package uses a post-autoload-dump install lifecycle script. This is a material install-time behavior that warrants awareness, although the signal does not show that the script is unsafe.

Repo bus factorcaution

All four recent commits came from one contributor, creating a meaningful continuity risk. Organization backing partly compensates because maintenance can potentially be handed off.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool is configured, leaving a repository hygiene gap.

Security policycaution

The repository has no security policy, reducing transparency for vulnerability reporting and coordinated fixes.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings. However, both of its action references are unpinned, which is a supply-chain hygiene weakness.