spits-online/laravel-openprovider-api

Lifecycle scriptscaution

The package uses a post-autoload-dump install-time script. This is a mild supply-chain and installation-complexity concern, though the signal does not show a dangerous script or additional behavior.

Release historycaution

The package has only 3 releases over 483 days, with a median interval of about 231 days. The latest release was published recently, which reduces abandonment concern but does not offset the slow overall cadence entirely.

Repo commit activitycaution

The repository recorded 2 commits in the last 3 months, with 2 active maintainers. This is limited activity, but the recent release and active contributors provide some compensation.

Security policycaution

No security policy was found in the repository, leaving vulnerability-reporting expectations unclear.

Workflow auditcaution

All 4 workflows were analyzed, but all 9 action references are unpinned, 2 workflows grant top-level write permissions, and a high-confidence bot-conditions finding was reported in the Dependabot auto-merge workflow. No untrusted checkout or script-injection sink was found, so this is a hygiene concern rather than a severe workflow risk.