sodalitedana/laravel-bugsnag-download-logs

Dangerous workflowscaution

One workflow uses pull_request_target for Dependabot auto-merge, which can require careful trust-boundary handling. No untrusted checkout or script-injection patterns were detected, limiting the concern.

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is an additional installation behavior that merits review, although the signal alone does not establish a severe dependency risk.

Maintainerscaution

Only one registry account has publishing access. The repository is also user-owned rather than organization-backed, so there is little demonstrated maintainer redundancy if that person stops supporting the package.

Release historycaution

The package is relatively young, with eight releases over about 12 months and releases concentrated in the last 12 months. That provides some release evidence but not a long maturity record.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. For a package released within the past year, this is a meaningful maintenance and abandonment concern, despite the repository not being archived.