spatie/schema-org

Name lookalikedanger

The package is flagged as borrowing the identity of the much more downloaded spatie/image, and borrows_lookalike_identity is true. Despite zero artifact overlap and no README claim of being a fork, consumers could mistake this package for spatie/image, which is a serious supply-chain concern.

Repo bus factorcaution

One contributor made five of six recent commits, creating concentration risk, although the organization-backed project and a second active contributor partly compensate.

Repo toolingcaution

Composer is used for builds, but no security-scanning tooling was detected, leaving automated security coverage limited.

Security policycaution

The repository has no SECURITY.md or other declared security policy, leaving vulnerability reporting and response expectations less transparent.

Workflow auditcaution

All seven analyzed action references are unpinned, and a high-confidence audit found an unpinned container image in php-cs-fixer.yml. The workflows have no untrusted checkout or script-injection findings, but the release automation is less reproducible than it should be.