dmk/mkmailer

Release historycaution

The package has existed since 2016 with 43 releases, but only one release in the last 12 months indicates a slow current cadence. The recent release provides some evidence of continued maintenance, so this is a moderate concern rather than abandonment.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. This weakens evidence of active maintenance, although the repository had a recent push and the package released during the broader period.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. That is a transparency and hygiene gap, not evidence that the package is unmaintained.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations unclear for a package that handles email delivery.

Workflow auditcaution

All 11 action references are unpinned, and the release workflow contains a high-confidence template-injection finding. The workflows have no top-level permissions block, which is acceptable on its own, but the CI hygiene warrants caution.