waaz/sylius-mondial-relay-plugin

Release historycaution

The package published 19 releases in roughly five days, but the latest release was about six months before collection, indicating a short, bursty history rather than established ongoing maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months. For a package released only months earlier, that is a meaningful maintenance concern.

Repo popularitycaution

The repository has zero stars and one fork, showing limited public adoption. Popularity is only supporting evidence, so this modestly reduces confidence in maturity rather than deciding the verdict.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations less transparent.

Workflow auditcaution

All seven analyzed action references are unpinned, which weakens workflow reproducibility. The reported cache-poisoning findings are low-confidence hygiene warnings, so they do not independently raise this to a severe supply-chain concern.