meruhook/meruhook-sdk

Release historycaution

Only three releases were published, all clustered within about one day, and none appeared in the last 12 months despite the package being about 13 months old. This is meaningful abandonment risk.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap and suggesting maintenance has stopped.

Security policycaution

The linked repository has no security policy, reducing vulnerability-reporting transparency for an SDK that handles API credentials, though this is not evidence of a defect.

Workflow auditcaution

All 10 action references are unpinned, and one workflow grants top-level write permissions; the audit also reports high-confidence template-injection findings, which are workflow hygiene concerns without an untrusted trigger or checkout sink.