spatie/packagist-api

Name lookalikedanger

The signal says this package borrows the identity of the much larger spatie/backtrace package, with 6,138,662 monthly downloads versus 155,782. Although artifact overlap is zero and the README does not identify it as a copy, the reported identity borrowing creates a serious risk that consumers wanted the lookalike instead.

Release historycaution

The project has existed since 2016 and released once in the last 12 months, with a median interval of about 225 days. This is a slow but not abandoned release cadence.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. That is a modest transparency gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy. For a library that makes external API requests, this weakens the project's documented vulnerability-reporting process.

Workflow auditcaution

All three workflows were analyzed without high-confidence audit findings or untrusted checkouts, but all nine action references are unpinned and one workflow has top-level write permissions. These are workflow hygiene and supply-chain weaknesses, not a standalone severe risk.