razorpay

Build provenancecaution

No build attestation or trusted publisher identity is present. The active organization-backed repository and published release notes provide some transparency, but artifact origin is not independently attested.

Lifecycle scriptscaution

A prepublish lifecycle script runs during publishing. This is a mild supply-chain and reproducibility consideration, although the signal does not show an install-time script executed by consumers.

Release historycaution

The package is mature at roughly 10 years old with 40 releases, but only one release occurred in the last 12 months. Active repository commits partly compensate, though the registry cadence is relatively sparse.

Repo issue activitycaution

The repository has 72 open issues and 61 open pull requests, with no issues closed in the last month and no pull requests merged. Two new pull requests show some activity, but backlog resolution is weak.

Security policycaution

No security policy file was found in the repository. Dependabot and Semgrep provide some security practice, but they do not replace clear vulnerability-reporting guidance.