dingdayu/pinduoduo-sdk

The package has clear ownership, a matching repository, a usable README, and an MIT license. Its small dependency surface and lack of install scripts help, but the project shows no recent maintenance and limited security hygiene.

Latest v1.3.2

Packagist

42%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has had no release in over five years: all eight releases were published in January 2021, with none in the last 12 months. This is strong evidence of abandonment for an API integration library.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the unchanged release history. No newer activity compensates for the prolonged inactivity.

Repo popularity

The repository has zero stars, forks, and watchers, providing no meaningful community support signal. Popularity is only supporting evidence, so this reinforces rather than determines the maintenance concern.

Security policy

The repository has no security policy and no security scanning tools. This weakens transparency and vulnerability-reporting hygiene, though it is not by itself evidence of unsafe code.

Workflow audit

The single workflow was fully analyzed and has no detected dangerous sinks or audit findings, but its only action use is unpinned. The absence of a top-level permissions block is acceptable here; the unpinned action is a minor supply-chain hygiene gap.