optimisthub/moka-woocommerce

Licensecaution

The manifest declares MIT, but the artifact license detector identifies LGPL-3.0 while a license file is present. The package is licensed, but the unresolved mismatch creates a real adoption and compliance concern.

Repo bus factorcaution

All recent repository activity came from one contributor, giving the project a narrow recent maintenance base. Organization backing provides some handoff capacity, so this is a caution rather than a severe risk.

Repo commit activitycaution

Only 1 commit was recorded in the last 3 months, which is thin recent maintenance activity for a payment integration. The recent release and repository push provide some compensating evidence but do not remove the concern.

Repo toolingcaution

Composer is used for builds, showing basic build tooling, but no security scanning tools were detected. The missing scanning is a modest transparency gap rather than evidence of abandonment.

Security policycaution

The linked repository has no security policy. For a WooCommerce payment plugin, the absence limits guidance for reporting and handling security issues.