twintylabs/laravel-userstamps

Lifecycle scriptscaution

A post-autoload-dump install-time script is present, adding execution during installation. This is common Composer package behavior but still increases installation complexity compared with a package without lifecycle hooks.

Release historycaution

The package is only 0 days old with three releases published within a short period, so there is not enough history to demonstrate sustained maintenance or stability.

Repo commit activitycaution

There were no commits or active maintainers in the last three months, although the repository was only created or updated very recently. The current activity is therefore encouraging but not yet a sustained maintenance record.

Security policycaution

No security policy was found in the repository. This is a transparency gap, though its impact is limited for a small package with very little operating history.

Workflow auditcaution

All five workflows were analyzed, but all 12 action references are unpinned. The audit also found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow; the pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a hygiene concern rather than a standalone severe risk.