omakei/laravel-nhif

Release historycaution

The package is about four years old but has only four releases, with one release in the last 12 months and a median interval of about 236 days. The recent 2.2.0 release provides some evidence of ongoing maintenance, but the cadence is sparse.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although the release was recent, the current lack of source activity lowers confidence in ongoing maintenance.

Repo popularitycaution

The repository has 11 stars, 4 forks, and 3 watchers. Popularity is only supporting evidence, but these modest figures indicate a small project with limited visible community depth.

Security policycaution

The repository has no security policy. This is a transparency and response-process gap, though it is not by itself evidence that the package is unsafe.

Workflow auditcaution

All 12 analyzed action references are unpinned, weakening build reproducibility. The audit also found one high-confidence bot-conditions issue in the Dependabot auto-merge workflow; the pull_request_target trigger has no untrusted checkout or script-injection sink, so this remains a hygiene concern rather than a severe risk.