payumea/gateway-magento

The package includes a clear README, changelog, Composer build tooling, and CodeQL scanning, with organization backing. Its unpinned workflow actions, missing security policy, and recent lack of repository commits leave meaningful maintenance and release-process concerns.

Latest 0.5.4

Packagist

64%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, a concrete sign that maintenance has recently paused.

Repo issue activity

There were no new or closed issues and no pull requests in the last month, while four issues remain open; this provides little evidence of active issue handling.

Security policy

No security policy was found in the repository, reducing transparency about vulnerability reporting for a payment integration.

Version stability

Version 0.5.4 is not a stable major release, so compatibility expectations are lower than for a 1.x package; it is nevertheless not a prerelease.

Workflow audit

The single workflow was fully analyzed with no untrusted checkout or script-injection findings, but all 8 action references are unpinned and the workflow grants top-level write permissions. These are workflow-hygiene concerns, not severe risks on their own.