univapay/univapay-sdk-compat

Release historycaution

The package is only 43 days old, with three releases clustered over about one day, so there is limited evidence of long-term maintenance even though release activity is recent.

Repo bus factorcaution

One contributor made all six recent commits, creating a thin individual maintenance base. The organization-owned repository provides some handoff capacity, so this is a caution rather than a severe risk.

Repo commit activitycaution

Six commits occurred in the last three months, showing recent work, but the activity is modest for a newly published compatibility package.

Security policycaution

The repository has no published security policy, leaving reporting and response expectations undocumented.

Workflow auditcaution

The single workflow was fully analyzed with no reported audit findings or untrusted checkout and injection sinks. However, all 12 action references are unpinned, which weakens build reproducibility and supply-chain control.