andreighioc/ingwebpay

Project backingcaution

The registry namespace and repository are owned by the same individual account. This is coherent ownership, but it does not provide organizational backing or a broader maintenance base.

Release historycaution

Only two releases have been published, both within a few hours on the first release day, so there is limited evidence of sustained maintenance or release discipline.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. For a package only about five months old, that is a meaningful warning about current maintenance capacity.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. This is a hygiene gap rather than evidence that the package is unsafe.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, both action references are unpinned, leaving avoidable build-integrity risk.