einvoicing/sdk

Release historycaution

Seven releases were published within a few hours on the package's first day. This shows active initial iteration, but provides no evidence of longer-term maintenance.

Repo commit activitycaution

The repository records no commits or active maintainers over the last three months, but the repository was only created or updated on the assessment day, so this is mainly a lack of history rather than confirmed abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations undocumented. This is a transparency gap, though not evidence of unsafe code.

Version stabilitycaution

Version v0.3.0 is not a stable major release, so the API may still change; it is not marked as a prerelease, which partly offsets the concern.

Workflow auditcaution

The workflow has read-only permissions, no untrusted checkout or injection findings, and the audit completed fully. All six action references are unpinned, creating a modest reproducibility and supply-chain hygiene concern.