hedeqiang/yeepay

Release historydanger

The package has had four releases, but all were clustered over roughly two days and none were published in the last four years. That strongly raises abandonment risk for a dependency.

Repo commit activitydanger

There were zero commits and zero active maintainers in the last three months, consistent with a project that has been inactive for about four years.

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts. These increase installation-time execution exposure and deserve review, although the signal alone does not establish that the scripts are unsafe.

Project backingcaution

The package and repository are owned by the same individual account, so the release is not backed by an organization with an evident larger maintenance base.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. For a payment SDK, that is a meaningful transparency and maintenance gap.