multisafepay/php-sdk

The package has clear documentation, a matching source repository, a license, and a release note for this version. Its small community, absent security policy, and unpinned workflow actions leave maintenance and build hygiene concerns.

Latest 5.21.1

Packagist

72%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Are you affected? Scan for Free

Health Score Breakdown

Repo commit activity

No commits and no active maintainers were recorded in the three months before collection. The recent release history partly offsets this, but the short-term absence still raises maintenance risk.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a modest hygiene gap for a payment SDK.

Security policy

The repository has no security policy. For an SDK handling payment integrations, this reduces transparency around vulnerability reporting and response.

Workflow audit

All four workflows were analyzed without dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 10 action references are unpinned, which weakens build reproducibility and update safety.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2025-10581 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. multisafepay/php-sdk is vulnerable to Timing Attacks in versions 5.1.0 - 5.17.0.	5.1.0 - 5.17.0	Low

Package versions

Maintainers

No maintainer information available.

Direct Dependencies

Dependency	Last Release	Score
php-http/discovery Version ^1.0	—	—
psr/http-client-implementation Version ^1.0	—	—
psr/http-factory-implementation Version ^1.0	—	—
psr/http-message-implementation Version ^1.0	—	—