leefipay/mpesa

Release historycaution

The package is only 45 days old and has three releases, all published within one day. This shows initial activity but provides little evidence of sustained maintenance.

Repo bus factorcaution

All four recent commits came from one contributor, leaving no demonstrated handoff capacity if that maintainer becomes unavailable.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. This is a hygiene gap rather than evidence of unsafe code.

Version stabilitycaution

Version v0.1.2 is a non-stable-major release, so compatibility and API stability are not yet established. It is not marked as a prerelease, which partly offsets the concern.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no detected injection or high-confidence audit findings. However, all five action references are unpinned, leaving workflow dependencies exposed to upstream changes.