yieldstudio/laravel-expo-notifier

Lifecycle scriptscaution

A post-autoload-dump install-time script is present. Such scripts can run code during installation, so this is a supply-chain hygiene concern, although the signal does not show that the script is harmful.

Release historycaution

The package has 17 releases since November 2022, but none in the last 12 months; the latest release was over a year ago. This is a meaningful maintenance concern, though the project is not very old and has a documented latest release.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, following a latest push over a year ago. That indicates currently limited maintenance capacity and raises abandonment risk.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. For a maintained package this is a modest assurance gap, not evidence that the release is unsafe.

Security policycaution

The repository has no security policy. This weakens transparency around vulnerability reporting and response, though it is a smaller concern than the maintenance slowdown.