ddliu/wxpay

Release historydanger

The package has only 3 releases, all clustered in September 2015, with no releases in the last 12 months and a latest release about 11 years ago. This strongly indicates abandonment risk.

Repo commit activitydanger

The repository recorded 0 commits and 0 active maintainers in the last 3 months, consistent with its last push being about 11 years ago. The non-archived status does not compensate for the lack of recent work.

Package file treecaution

The published tree includes certificate and private-key-named files under an example directory. Their contents are not established here, but distributing such files in payment SDK material warrants extra caution.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. That leaves a meaningful transparency gap for a payment-focused package, although it is not evidence of a vulnerability by itself.

Security policycaution

The repository has no security policy, leaving no documented channel or process for reporting vulnerabilities. This matters more for a payment integration than for a low-risk utility.