wmbh/laravel-asana

Dangerous workflowscaution

One pull_request_target workflow is used for Dependabot auto-merge, but no untrusted checkouts or script-injection patterns were detected across five analyzed workflows. The remaining pattern warrants awareness but is not severe here.

Maintainerscaution

Only one account has registry publish access, creating some continuity risk. The matching source repository provides backing evidence, but the single-publisher setup remains a caution.

Project backingcaution

The registry namespace matches the repository owner, but the owner is an individual user rather than an organization. This supports package identity while offering limited evidence of institutional continuity.

Release historycaution

The package is young at 198 days and has four releases, including a release within minutes of collection. This shows ongoing publication, though the relatively small history limits maturity evidence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months. This is a concrete maintenance concern, although the recent push and release activity provide only partial compensation.