overtrue/laravel-easy-sms

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts, which increase installation-time execution exposure. No provided signal shows that these scripts are unsafe.

Release historycaution

The project has released for more than four years, with one release in the last year and a typical interval of about six months. This shows ongoing but relatively infrequent maintenance.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, indicating a current lull. The recent release and repository push provide some evidence against full abandonment but do not remove the concern.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency for a package handling integrations and credentials.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, injection findings, or audit failures. However, all four action references are unpinned, leaving them exposed to upstream changes.