sparkcrm/spark-sdk

Release historycaution

This is the package's only release, published 98 days ago, so there is little release history to demonstrate sustained maintenance.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, which is concerning for a package only 98 days old.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy, reducing clarity about how vulnerabilities should be reported and handled.

Workflow auditcaution

All 8 analyzed action uses are unpinned, and the release workflow has two high-confidence template-injection findings; these are workflow hygiene risks, though no untrusted checkout or script-injection sink was found.