malpka32/inpost-buy-sdk
The package has a strong README, tests, changelog, and frequent releases. CI avoids untrusted checkout and script injection, but its four action references are unpinned and maintenance is currently concentrated in one contributor.
67%
Total Score
50
100
100
67
Health Score Breakdown
One contributor made 100% of the commits in the last three months, leaving maintenance dependent on a single person with no demonstrated handoff capacity.
Only one commit was recorded in the last three months, indicating limited recent development activity despite the frequent registry releases.
The repository has no security policy, which reduces transparency for reporting and handling vulnerabilities in an SDK that manages API authentication and commerce operations.
The sole workflow was fully analyzed and has no untrusted checkout or script-injection findings, but all four action references are unpinned. A low-confidence cache-poisoning finding is hygiene evidence rather than a severe risk on its own.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 malpka32 |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 symfony/mime Version ^6.4 || ^7.0 | — | — |
ramsey/collection Version ^2.0 | — | — |
symfony/http-client-contracts Version ^2.5 || ^3.0 | — | — |
Weekly Downloads
Info
- Last Published
- 2 days ago
- Created
- 7 months ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.