victord11/laravel-msgraph-mail

Dangerous workflowscaution

One of five workflows uses pull_request_target for Dependabot auto-merge, which carries elevated workflow trust risk, although no untrusted checkout or script-injection pattern was detected.

Lifecycle scriptscaution

A post-autoload-dump script runs during installation, adding some install-time behavior that should be reviewed, but the signal does not show a severe or clearly unsafe action.

Maintainerscaution

Two registry publishing maintainers provide some release redundancy, but the zero active repository maintainers in the last three months shows that registry access does not demonstrate ongoing development.

Project backingcaution

The registry namespace and repository are owned by the same individual account, so the project has direct ownership alignment but no organization-level backing shown by this signal.

Release historycaution

Only two releases have been published across 437 days, with one release in the last 12 months, indicating a thin release history and limited evidence of sustained maintenance.