bolechen/gongmall-php-sdk
The package is clearly documented, licensed, and tested in its source repository. Its long period without releases, inactive repository, and unpinned workflow actions increase maintenance and supply-chain risk.
58%
Total Score
0
100
81
83
Health Score Breakdown
The latest release was over three years ago, with no releases in the last 12 months; the earlier 16-release history shows the project was once active but is now stale.
The repository recorded zero commits and zero active maintainers in the last three months, consistent with the extended release gap and raising abandonment risk.
The repository has only 1 star and 1 fork, so there is limited visible community support or review capacity; popularity is supporting evidence rather than a verdict.
The repository has no security policy, leaving no documented process for reporting or handling vulnerabilities in a package that integrates with an external business API.
The single workflow was fully analyzed with no high-confidence findings, but all 3 action references are unpinned. The missing top-level permissions block is acceptable on its own, while unpinned actions remain a supply-chain hygiene gap.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Bole Chen |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 hanson/foundation-sdk Version 3.0.*|^4.0.3|^5.0|dev-master | — | — |
Weekly Downloads
Info
- Last Published
- 3 years ago
- Created
- 7 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.