qruto/laravel-flora

Lifecycle scriptscaution

The package runs a post-autoload-dump lifecycle script, which is relevant because it executes during installation. The package's stated setup purpose makes this expected, but it still expands install-time behavior.

Release historycaution

Only three releases have been published since March 2023, with no registry release in the last 12 months and the latest release over two years ago. This weakens release transparency even though the repository shows recent activity.

Security policycaution

The repository has no security policy. That leaves vulnerability reporting and response expectations undocumented, although it is not evidence of abandonment by itself.

Workflow auditcaution

All six workflows were analyzed, but all 16 action references are unpinned. The audit also reports high-confidence bot-condition and template-injection findings, plus one workflow with top-level write permissions; no untrusted checkout or script-injection sink was found, so this is a meaningful hygiene caution rather than a standalone severe risk.