surecart/client

Licensecaution

The manifest declares MIT and the artifact license file is detected as MIT, but the README says GPL-2.0-or-later. That inconsistency creates a real licensing-transparency concern despite the available license files.

Release historycaution

The package has made no releases in the last 12 months, after five releases clustered within about one week in April 2025. This suggests maintenance has stopped, although the release history is not empty.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap. This is a meaningful abandonment concern for a client library.

Security policycaution

The linked repository has no security policy. This weakens vulnerability-reporting transparency, but it is a secondary concern because the repository is not archived and is organization-backed.

Workflow auditcaution

The single workflow grants top-level write permissions and both action references are unpinned. No untrusted checkout, script injection, or high-severity finding was detected, so this is workflow hygiene caution rather than a severe risk.