roundly-consulting/money-for-laravel

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is a supply-chain execution surface, though the signal does not show a dangerous script or malicious behavior.

Release historycaution

This is the first release and the package is 0 days old, so there is no release track record from which to judge long-term stability.

Repo bus factorcaution

All 32 recent commits came from one contributor, creating a real continuity risk; organization ownership provides some handoff capacity but no second active contributor is shown.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkout, script injection, or high-severity findings. However, all 12 action references are unpinned, leaving workflow dependencies exposed to moving revisions.