tsetsee/sylius-qpay-plugin

Release historydanger

The latest release was over three years ago, with no releases in the last 12 months; the six-release history is concentrated in the package's first few days. This is strong evidence of abandonment risk.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, while its last push was in May 2023. That leaves little evidence of ongoing maintenance.

Repo package mentioncaution

The repository name matches the package, but its README does not mention the package and instead presents generic plugin-skeleton documentation. That weakens package-specific transparency.

Security policycaution

The repository has no security policy, reducing transparency for reporting and handling vulnerabilities. This is a secondary concern because other security tooling is present.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkout or script-injection trigger, but all 9 action references are unpinned. The reported cache-poisoning findings are low confidence and therefore only hygiene concerns.