spatie/x-ray

Name lookalikedanger

The package is reported as borrowing the identity of spatie/array-to-xml, with borrows_lookalike_identity true. Although artifact overlap is 0.0 and the names differ semantically, this is strong evidence that consumers may have wanted the established lookalike instead.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last three months, which weakens evidence of ongoing maintenance. The recent release and push activity provide some counterweight but do not replace current commits.

Security policycaution

The repository has no security policy, leaving disclosure and response expectations undocumented. Dependabot and other repository tooling provide limited compensating evidence but do not replace a published policy.

Workflow auditcaution

The audit analyzed all 5 workflows with no failed files or findings, and the pull_request_target workflow has no untrusted checkout or script-injection sink. However, all 13 action references are unpinned, and one workflow grants top-level write access, creating a reproducibility and permissions-hygiene concern.