opauth/yinxiang

Release historydanger

The package has had no release in more than 11 years, with zero releases in the last 12 months. This is strong evidence of abandonment for a dependency intended for ongoing use.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the package's long release gap and increasing abandonment risk.

Repo package mentiondanger

The repository name does not match the package name and its README does not mention opauth/yinxiang. That makes package ownership and source provenance unclear rather than merely reflecting a normal subpackage layout.

Licensecaution

The manifest declares MIT, but the only detected license file is Apache-2.0 under Vendor/tmhOAuth. This licensing mismatch creates real adoption and compliance uncertainty.

Repo toolingcaution

The repository uses Composer for builds, providing basic project structure, but it has no security-scanning tooling. For this small, inactive project, that leaves a modest transparency and maintenance gap.