oralunal/laravel-clickhouse

Lifecycle scriptscaution

The package runs a post-autoload-dump lifecycle script. Install-time execution adds some supply-chain exposure, although the provided signal does not show dangerous behavior.

Maintainerscaution

Two registry publishing maintainers provide some publishing coverage, but the repository activity shows only one active contributor, so registry access does not fully offset the maintenance concentration.

Project backingcaution

The package and repository are both owned by the same individual account, confirming ownership consistency but providing no organization-level maintenance handoff.

Release historycaution

The package is effectively brand new: its first release was the same day as the latest release, with 10 releases and a zero-day median interval. That rapid initial history provides little evidence of durable maintenance.

Repo bus factorcaution

One contributor made all six commits in the last three months, with a 100% commit share. Because the repository is user-owned rather than organization-owned, there is no provided organizational backing to compensate for this concentration.