overtrue/laravel-filesystem-qiniu

Lifecycle scriptscaution

The package defines post-install and post-update Composer scripts, creating install-time behavior that deserves review even though this signal alone does not show that the scripts are unsafe.

Release historycaution

The package has existed since 2017 with 17 releases and a release within the last 12 months, but only one release in that period indicates a relatively slow maintenance cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a concrete sign that maintenance may currently be slow.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Token permissionscaution

The CI workflow does not declare top-level token permissions. No write permissions were observed, but the missing explicit restriction is a workflow hygiene gap.