The package is well documented and backed by an organization with repository tests, a changelog, security tooling, and an active initial development cycle. Its main concerns are the lack of release history, reliance on one contributor, and unpinned workflow actions.
68%
Total Score
75
92
75
This is the package's first release, published today, so there is no track record for release stability or long-term maintenance. Active repository commits provide some compensating evidence, but not release history.
All 25 commits in the last three months came from one contributor, creating a thin individual bus factor. Organization ownership provides some maintenance capacity, but no second active contributor is shown.
All 12 analyzed action references are unpinned, which weakens build reproducibility and leaves workflow dependencies exposed to future changes. The audit found no dangerous triggers, token misuse, or other high-confidence workflow findings, which limits the impact to caution.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
illuminate/contracts Version ^12.0|^13.0 | — | — |
roundly-consulting/enums-for-laravel Version ^1.0 | — | — |
roundly-consulting/approvals-for-laravel Version ^1.0 | — | — |
roundly-consulting/attributes-for-laravel Version ^1.0 | — | — |
roundly-consulting/media-library-for-laravel Version ^1.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.