boxberry-delivery/php-api-c2c

Release historydanger

The package has only one release, published about 8 years ago, with no releases in the last 12 months. That is strong evidence of abandonment risk for a dependency.

Repo commit activitydanger

There were no commits and no active maintainers in the last 3 months, consistent with the package's long release gap. The repository's last push was in October 2021, so this is not merely a short lull.

Package scaffoldingcaution

A README and changelog are present, but the README describes jqPlot rather than the Boxberry API package, reducing documentation transparency. The missing tests are normal packaging practice and do not offset the misleading content.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools are reported. That weakens maintenance hygiene, though it is less significant than the long-standing lack of release and commit activity.

Security policycaution

The linked repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a hygiene and transparency gap, not evidence of malicious behavior.