vmorozov/laravel-json-log-formatter

Workflow auditdanger

All 12 action references are unpinned, and a high-confidence audit found a bot-condition issue in a pull_request_target workflow; the absence of an untrusted checkout limits the severity, but workflow controls are still weak.

Lifecycle scriptscaution

A post-autoload-dump install-time script adds supply-chain and installation complexity compared with a package without lifecycle hooks.

Project backingcaution

The source repository is owned by an individual account rather than an organization, so there is no visible organizational maintenance backing to offset the thin activity.

Release historycaution

The package is about 18 months old with three releases, but only one release in the last 12 months and a median interval of about 132 days indicate a slow release cadence.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, a concrete sign that maintenance may have stalled.