jpblancodb/mercadopago

The package has a very small codebase and no automated security scanning. MIT licensing and a direct dependency are clear, but there is little evidence of ongoing maintenance or consumer guidance.

Latest v1.0.2

Packagist

35%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has had only two releases, both in June 2016, with no releases in about 10 years. This strongly raises abandonment risk, and no newer release activity compensates for it.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the last push being about 10 years ago. This is strong evidence that maintenance has stopped.

Package scaffolding

The artifact includes a README, but it is only 15 characters and provides no meaningful integration guidance. The absence of tests and a changelog is normal for a published artifact and is not itself a gap.

Repo popularity

The repository has one star, zero forks, and one watcher, providing little supporting evidence of community scrutiny or adoption. Low popularity is not decisive, but it does not offset the maintenance concerns.

Repo tooling

Composer is used as the build tool, but the repository has no security scanning tooling. This is a modest supply-chain hygiene gap rather than evidence that the release is unsafe.