ketapay/ketapay-php

Lifecycle scriptscaution

A post-install-cmd script runs during installation, creating extra supply-chain and reproducibility exposure compared with a package without install-time execution.

Release historycaution

This is the first release, published today, so there is no observed release cadence or history to establish long-term maintenance reliability.

Repo commit activitycaution

The repository reports zero commits and zero active maintainers in the last three months; the same-day release and recent merges partly offset this, but the maintenance record remains very short.

Version stabilitycaution

The assessed version is v0.1.0-beta.1 and all recent releases are prereleases, so the API and behavior may still change materially.

Workflow auditcaution

All five workflows were analyzed with no injection or high-severity findings, and most use read-only or job-level permissions. However, all 32 action references are unpinned and one workflow grants top-level write permissions, creating avoidable workflow risk.