j-muiruri/daraja-php-sdk

Maintainerscaution

Only one account has registry publishing access. That is not evidence of poor maintenance by itself, but it leaves publishing continuity dependent on one person.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-maintainer and concentrated-contributor concerns are not visibly offset by organizational backing.

Release historycaution

The package is young at 73 days, but it has six releases, including six in the last 12 months, with releases roughly every 16 hours at the median. This shows active early development but limited long-term evidence.

Repo bus factorcaution

All 22 recent commits came from one contributor, giving the project a concentrated bus factor. The recent activity helps, but no second active contributor is shown to provide continuity.

Workflow auditcaution

The audit found no untrusted checkouts, script injection, or severity-rated findings, and permissions are scoped in the analyzed workflows. However, all seven action references are unpinned, and one of two workflow files failed auditing, leaving avoidable build-integrity and coverage concerns.