overtrue/laravel-filesystem-cos

Lifecycle scriptscaution

Composer post-install and post-update scripts add install-time behavior that consumers should account for. No provided signal shows that these scripts are harmful, so this is a limited supply-chain hygiene concern rather than a severe risk.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. A recent release and repository push provide some compensating evidence, but the current maintenance pause raises abandonment risk.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injections, or audit findings. However, all four action references are unpinned, leaving CI dependent on mutable external revisions.