smknstd/fakerphp-picsum-images

Project backingcaution

The registry namespace and repository are owned by the same individual, so the ownership context is consistent, though it does not provide organizational backing.

Release historycaution

The package has only four releases since 2021 and none in the last 12 months, with a median interval of about 13 months. This suggests slow maintenance, though the package may be relatively stable.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Because the latest push coincided with the release, this is evidence of limited recent maintenance rather than abandonment by itself.

Workflow auditcaution

All three workflows were analyzed and had no untrusted checkout or script-injection findings, but all seven action references are unpinned and one workflow uses an unpinned container image with high-confidence severity. This is a meaningful CI supply-chain hygiene concern, not a release-blocking flaw on its own.