spatie/laravel-mix-preload

Name lookalikedanger

The package is flagged as resembling spatie/laravel-permission, with borrows_lookalike_identity true and only 229 monthly downloads versus 7,298,997 for the lookalike. Despite zero artifact overlap and a distinct README, this creates a severe risk that consumers wanted the better-known package.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, which is a maintenance concern. The recent release shown by release_history provides partial compensation but does not demonstrate ongoing development.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. For this small package, the missing scanning is a transparency gap rather than a severe risk.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear. This is a modest transparency concern for a dependency.

Workflow auditcaution

All 8 analyzed action references are unpinned, and the audit found a high-confidence unpinned container image in php-cs-fixer.yml. The workflows have no untrusted checkout or script-injection findings, so this is a CI hygiene concern rather than a direct severe compromise signal.