mollie-logeecom/sylius-plugin

Release historydanger

This package has only one release, published over three years ago, with no releases in the last 12 months. That is strong evidence of abandonment for an integration package that may need to track its platform and dependency ecosystem.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, while its last push was in May 2023. No newer activity is provided to offset the stale release history.

Repo package mentioncaution

The linked repository name does not match the package name and its README does not mention the package. That weakens confidence that the repository is the maintained source for this release, even though the package is a subproject-style integration.

Security policycaution

The repository has no published security policy. This reduces disclosure transparency for a payment integration, although it is secondary to the stronger maintenance concerns.

Workflow auditcaution

All 11 analyzed action references are unpinned, and the audit found high-confidence template-injection issues plus an ad hoc package installation. No untrusted trigger or checkout sink was reported, so these are workflow hygiene concerns rather than a severe standalone risk.