The package is a small, clearly scoped SDK snapshot with a matching repository, a README, and an Apache-2.0 declaration. Its repository has had no commits or releases for over a year, and it has no security scanning or policy. Pin this version only if the API snapshot meets your needs.
66%
Total Score
75
100
88
75
This is the package's only release, published over a year ago, with no releases in the last 12 months. That limits evidence of ongoing maintenance, though a generated SDK snapshot may reasonably change only when the upstream API changes.
The repository recorded zero commits and zero active maintainers in the last three months. Combined with the one-release history, this is meaningful evidence of limited current maintenance.
Composer build tooling is present, but no security-scanning tools were detected. For an SDK package this is a modest transparency and maintenance gap, not a severe risk by itself.
The repository has no security policy, leaving no documented channel or process for reporting vulnerabilities. This lowers transparency but is not enough alone to make the release unfit.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
alibabacloud/client Version ^1.5 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.