spatie/twitter-labs

Name lookalikedanger

The package is flagged as borrowing the identity of spatie/ray, with borrows_lookalike_identity true. Although artifact overlap is low and the repository is organization-backed, this remains a serious adoption risk because consumers may have intended the lookalike package.

Release historydanger

The latest registry release was about six years ago, with no releases in the last 12 months. The four releases were concentrated in a short initial period, which is strong evidence of an aging package.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This supports the concern that the package is not receiving ongoing maintenance, despite a recent repository push signal elsewhere.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency, although it is a secondary concern compared with the package's stale release and maintenance history.

Workflow auditcaution

Both workflows were analyzed without untrusted checkouts or script injection, but all four action references are unpinned and the audit found a high-confidence unpinned container image. This is a real reproducibility and supply-chain hygiene concern.