spatie/lighthouse-php

Name lookalikedanger

The package is reported as borrowing the identity of the much more established spatie/ignition, with 5,380,565 monthly downloads versus 7,549. Although artifact overlap is zero and the README does not identify it as a lookalike, the identity signal creates a serious adoption risk.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last 3 months. This suggests a current maintenance lull, though the recent release history and June 2026 push provide some counterevidence.

Security policycaution

No repository security policy was found, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All 11 analyzed action references are unpinned, and the test workflow installs packages outside a lockfile, creating reproducibility and dependency-integrity concerns. The pull_request_target workflow has no untrusted checkout or script-injection sink, so its write token is not a danger on its own.