vmorozov/laravel-prometheus

Project backingcaution

The registry namespace and repository owner are different individual accounts, so the package does not show organization backing. This weakens visible ownership continuity, although the repository is clearly linked to the package.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months. This is a meaningful maintenance concern despite the recent release history.

Repo popularitycaution

The repository has zero stars and forks and only one watcher. Popularity is supporting evidence rather than a verdict, but these counts provide little external evidence of maturity.

Security policycaution

The repository has no security policy. For a package that exposes application metrics, this is a transparency gap, though it is not severe on its own.

Workflow auditcaution

All nine analyzed action references are unpinned, three workflows grant top-level write permissions, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. No untrusted checkout or script injection was found, but the workflow configuration still warrants caution.