farzai/promptpay

Maintainerscaution

Only one registry publishing account is listed, which is a thin publishing base. The repository is organization-owned, so this is less concerning than a one-person project with no organizational backing.

Release historycaution

The package has five releases over about three years, with one release in the last 12 months and a median interval of about eight months. The recent 3.0.0 release is positive, but the cadence is modest.

Repo commit activitycaution

There were zero commits and zero active maintainers during the last three months. A recent release provides some compensation, but the current pause still raises maintenance risk.

Security policycaution

The repository has no published security policy. That is a transparency gap for a library that may be used in payment-related integrations, with no provided signal showing that the gap is covered.

Workflow auditcaution

All 10 analyzed action references are unpinned, and three workflows grant top-level write permissions. The high-confidence bot-conditions finding in the Dependabot auto-merge workflow adds release-automation risk, although no untrusted checkout or script injection was found.