yannelli/entry-vault-laravel

Repository archiveddanger

The linked repository is archived even though it was pushed 14 days ago, making future fixes and issue handling unreliable. This is a severe abandonment risk for a package intended as a backend dependency.

Workflow auditdanger

All 12 action references are unpinned, three workflows grant top-level write permissions, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. No untrusted checkout or script injection was found, but the automation still presents meaningful supply-chain hygiene risk.

Maintainerscaution

Only one account has registry publishing access. That is consistent with the user-owned project, but it leaves little redundancy if the publisher becomes unavailable.

Repo bus factorcaution

One contributor made 100% of the 3 recent commits, leaving the project dependent on a single individual for maintenance. The matching user-owned repository provides no organizational handoff shown by the collected evidence.

Repo commit activitycaution

The repository had only 3 commits in the last 3 months, all from one active maintainer. Recent release activity partly offsets the low volume, but it does not show broad ongoing maintenance capacity.