sendkuy/sdk

Release historycaution

This is the package's first release, published today, so there is no release track record to demonstrate sustained maintenance or stability.

Repo commit activitycaution

There were no commits or active maintainers recorded in the prior three months. Because the package is only one day old, this mainly shows limited history rather than confirmed abandonment.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest repository-hygiene gap.

Workflow auditcaution

All 9 referenced actions are unpinned and one release workflow grants top-level write permissions, increasing workflow supply-chain exposure. The reported cache-poisoning finding is low-confidence, so it is treated as hygiene rather than a severe risk.