swedbank-pay/magento2-core

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts, which expand install-time behavior beyond file extraction. No accompanying evidence shows those scripts are unsafe, so this is a limited supply-chain caution rather than a severe risk.

Release historycaution

The package has had no releases in the last 12 months, and its latest release was in April 2021 despite being assessed as version 1.5.1. This materially raises abandonment risk.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, indicating no recent maintenance capacity. The repository is not archived, but that does not offset the inactivity.

Security policycaution

The linked repository has no security policy, leaving vulnerability-reporting expectations and contact guidance undocumented. This is a transparency gap for a payment integration.

Workflow auditcaution

The workflow audit completed successfully and found no untrusted checkouts or script injection, but all eight action references are unpinned and one high-severity cache-poisoning finding has low confidence; the high-confidence archived-action finding is a hygiene concern.