ritechoice23/laravel-fluent-ffmpeg

Workflow auditdanger

All 12 analyzed action references are unpinned, and three workflows grant top-level write permissions. A high-confidence bot-conditions finding occurs in a pull_request_target workflow, making the automation hygiene materially weaker even though no untrusted checkout or script-injection sink was found.

Maintainerscaution

Only one registry account has publish access, and the project is user-owned rather than organization-backed. That creates a thin publishing and continuity base, although access records alone do not establish actual activity.

Project backingcaution

The registry namespace and repository are owned by the same individual account, and no organization backing is shown. This matches the single-maintainer picture and provides limited continuity assurance.

Release historycaution

All six releases occurred within roughly 17 minutes on the same day, so the package has little demonstrated release cadence despite being about 9 months old. That limits evidence of sustained maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. For a package released in a concentrated burst, this provides weak evidence of ongoing maintenance.