Tests, licensing, focused dependencies, and organization backing improve transparency. Workflow references are unpinned, while the audit found template-injection patterns without an untrusted trigger; maintenance remains the main concern.
43%
Total Score
50
25
The package has had only two releases, both nearly 11 years ago, with no releases in the last 12 months. That strongly suggests the published release is effectively abandoned.
The repository recorded no commits and no active maintainers in the last 3 months. Recent merged pull requests provide some activity, but not enough to offset the lack of ongoing commit ownership.
Version 0.1.1 is not a stable major release, which adds maturity uncertainty for a package with an already very old release history.
All 10 analyzed action references are unpinned, and the audit reported two high-confidence template-injection findings. No pull_request_target, workflow_run, untrusted checkout, or script-injection trigger was reported, limiting the immediate severity.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
nailsapp/module-order-payment Version dev-develop | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.