vmorozov/laravel-http-client-requests-logger

Dangerous workflowscaution

One workflow uses pull_request_target, which can be risky when handling untrusted contributions, although no untrusted checkout or script injection was detected.

Lifecycle scriptscaution

A post-autoload-dump Composer script runs during installation, which adds some supply-chain and installation complexity; the signal does not show that it is unsafe.

Maintainerscaution

Only one account has registry publish access, limiting publishing redundancy. The linked repository is user-owned rather than organization-backed, so there is no provided evidence of a broader institutional maintainer base.

Release historycaution

The package is about 493 days old with six releases, but only one release occurred in the last 12 months, indicating a slow release cadence for a still-young package.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a concrete sign that maintenance may have slowed or stopped.