spatie/laravel-export

Name lookalikedanger

The package is reported to borrow the identity of spatie/laravel-ray, which has far more downloads and stable releases; this strongly suggests consumers may have intended that other package despite zero artifact overlap.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting and response expectations unclear.

Workflow auditcaution

All 10 analyzed GitHub Actions references are unpinned, creating reproducibility and action-substitution risk. The pull_request_target workflow has no untrusted checkout or script-injection sink, which limits the severity.