richan-fongdasen/database-converter-laravel

Dangerous workflowscaution

One workflow uses pull_request_target, which can be risky when handling untrusted pull requests. No untrusted checkout or script-injection patterns were detected, limiting the concern.

Lifecycle scriptscaution

A post-autoload-dump install-time script is present. This is an extra installation action, but the signal provides no evidence that it is harmful or unusual for this package.

Maintainerscaution

Only one account has registry publish access, leaving a thin publishing base. The linked repository is personally owned, so there is no organization backing shown to compensate for that concentration.

Project backingcaution

The registry namespace and repository owner match, but the owner is an individual user rather than an organization. This supports package identity but does not provide organizational continuity.

Release historycaution

This is the only release, published about 2 years and 4 months ago, with no releases in the last 12 months. That limited release history raises uncertainty about ongoing maintenance.