sharpapi/laravel-ecommerce-thank-you-email

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is a modest supply-chain and installation-complexity concern, although only one lifecycle hook is declared.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the past three months. That weakens evidence of ongoing maintenance despite the recent release history and recent repository push timestamp.

Repo popularitycaution

The repository has zero stars, forks, and watchers. Popularity is only supporting evidence, so this lowers external validation modestly but does not outweigh the maintenance and release signals.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a repository hygiene gap, not evidence that the package is unsafe.

Security policycaution

The repository has no security policy. This limits transparency about vulnerability reporting and response expectations, though it is less serious for a small package than an archived or deprecated project.