plin-code/laravel-instagram-digest

Lifecycle scriptscaution

A post-autoload-dump install script is present. This is a supply-chain and installation-behavior consideration, but the signal provides no evidence that the script performs unsafe actions.

Release historycaution

This is the sole release, published 158 days ago, so there is little release history to demonstrate sustained maintenance. The repository was pushed recently, which partly offsets the limited registry history.

Repo commit activitycaution

The repository records zero commits and zero active maintainers in the past three months. That weakens evidence of ongoing maintenance, although the recent push date provides some contrary context.

Security policycaution

No repository security policy is present. This is a transparency gap for a package handling external APIs, Telegram webhooks, and credentials, though it is not evidence of abandonment by itself.

Workflow auditcaution

All 12 action references are unpinned, and three workflows grant top-level write permissions. The audit also found a high-confidence, high-severity bot-condition issue in the Dependabot auto-merge workflow; no untrusted checkout or script-injection sink was detected.