overtrue/laravel-qcloud-captcha

Lifecycle scriptscaution

Composer post-install and post-update scripts add install-time behavior that consumers should review, although the signal does not show that the scripts are harmful.

Release historycaution

The package has six releases over about five years, with a median interval of about 371 days and only one release in the last 12 months. The recent release shows activity, but the cadence is sparse.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. A release during that period provides some compensating evidence, but ongoing maintenance activity remains thin.

Security policycaution

The repository has no published security policy, leaving maintainers' vulnerability-reporting process unclear.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all four action references are unpinned, which weakens build reproducibility and supply-chain transparency.