spatie/sourcemaps-lookup

Name lookalikedanger

The indicator reports that the package borrows spatie/color’s identity, despite zero artifact overlap and no self-described fork; consumers may have intended the established lookalike instead.

Release historycaution

This is a 149-day-old package with only one release and no established release cadence, leaving long-term maintenance maturity unproven.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, indicating limited recent development activity for a newly released package.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting guidance undocumented.

Workflow auditcaution

All four workflows were analyzed without audit findings and the pull_request_target workflow has no untrusted checkout or script-injection sink. However, all nine action references are unpinned and three workflows grant top-level write access, creating a moderate reproducibility and permissions concern.