lancodev/lunar-paypal

The package has a clear README, changelog, repository tests, and an MIT license. Its small team, inactive release history, and recent lack of commits make future compatibility less certain, while workflow pinning needs attention.

Latest 0.16

Packagist

55%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has 23 releases and historically released about every 6 days, but it has had no release in roughly two years. That sustained pause raises maintenance and compatibility concerns.

Repo commit activity

The repository recorded 0 commits and 0 active maintainers in the last 3 months. Although the repository is not archived, the current lack of development activity weakens confidence in ongoing maintenance.

Security policy

The repository has no security policy, leaving vulnerability-reporting expectations unclear for a payment integration. Dependabot provides some compensating security tooling, but it does not replace a reporting policy.

Version stability

Version 0.16 is not a prerelease and recent releases contain no prerelease versions, although the pre-1.0 major version leaves more room for breaking changes than a stable major release.

Workflow audit

All 12 analyzed action references are unpinned, and the audit found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow. The pull_request_target workflow has no untrusted checkout or script-injection sink, so this is a hygiene concern rather than a severe risk.