sanmai/sdk-common
Clear licensing, tests, and release notes make the package easy to inspect. Maintenance has gone quiet recently, while the workflows use unpinned actions and contain a high-confidence template-injection hygiene issue.
62%
Total Score
75
93
67
Health Score Breakdown
The package has existed for about 6 years with 32 releases, but the latest release was about 14 months ago and there were no releases in the last 12 months. That suggests slowing maintenance despite a substantial release history.
There were no commits and no active maintainers in the last 3 months. Although the repository was pushed more recently, the measured recent commit activity still indicates a maintenance slowdown.
The repository has no security policy. For a reusable API SDK component, that reduces the transparency of vulnerability reporting and response expectations.
All 6 action references are unpinned, and the audit found a high-confidence template-injection issue in autoapprove.yaml. No untrusted checkout or script-injection path was reported, so this is workflow hygiene caution rather than a severe dependency verdict.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Alexey Kopytko |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 sanmai/pipeline Version ^6.14 || ^7.0 | — | — |
psr/http-message Version ^2.0 | — | — |
guzzlehttp/guzzle Version ^6.5.8 || ^7.9.3 | — | — |
doctrine/collections Version ^2.3 | — | — |
sanmai/json-serializer Version ^0.2.7 | — | — |
Weekly Downloads
Info
- Last Published
- 1 year ago
- Created
- 6 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.