redberry/laravel-cloud-sdk

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script, which increases installation behavior and review surface. No evidence shows that the script is unsafe, so this is a limited caution rather than a severe risk.

Release historycaution

Only 2 releases exist over roughly 5 months, with the latest released about 5 months ago; this gives limited evidence of long-term maintenance. The regular roughly 9-day interval between releases and the young project age partly offset that gap.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last three months, which is a meaningful maintenance concern. The package is young and was pushed recently, so this is caution rather than abandonment evidence.

Workflow auditcaution

The audit found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow, and all 14 analyzed action references are unpinned; the single pull_request_target trigger is not dangerous by itself because no untrusted checkout or script injection was found. Top-level write permissions in two workflows add mild hygiene concern.