digitalstars/vk_api

Registry deprecationdanger

Packagist marks the entire package as abandoned and points to a replacement repository, which is a direct warning against taking a new dependency on this package.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months, indicating stalled recent maintenance despite the recent push timestamp.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the link does not clearly establish that this repository publishes the assessed package.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented for a library handling API credentials and bot integrations.

Workflow auditcaution

All three action references are unpinned, and the audit found a high-confidence template-injection issue plus an archived action. The workflow has no dangerous external trigger or untrusted checkout, so this is a hygiene concern rather than a standalone severe risk.