open-southeners/extended-laravel

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is a supply-chain and installation-behavior consideration, although the signal does not show that the script is unsafe.

Repo bus factorcaution

All recent commits come from one contributor, creating concentrated maintenance capacity. Organization ownership provides some handoff potential, but no second active contributor is shown.

Repo commit activitycaution

Only two commits were made in the last three months by one active maintainer. Recent activity is positive, but the low volume limits evidence of sustained maintenance.

Version stabilitycaution

Version 0.8.1 is not a prerelease, but remaining below 1.0 commonly indicates that breaking API changes may still occur between releases.

Workflow auditcaution

All four workflows were analyzed with no untrusted checkout or script-injection trigger, but all 13 action references are unpinned and the publish workflow has a high-confidence template-injection finding. These are meaningful workflow hygiene and release-integrity concerns, though template injection alone is not an automatic severe verdict.