wi1dcard/alipay-sdk

Clear licensing, tests, release notes, and a small dependency surface support adoption. The project has had no releases in nearly five years and no commits in the last three months, while its workflows use an unpinned container image.

Latest v2.0.3

Packagist

57%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has 25 releases since July 2018, but none in the last 12 months; its latest release was in October 2021, indicating prolonged release inactivity.

Repo commit activity

There were no commits and no active maintainers in the last three months, a concrete sign that ongoing maintenance has stalled.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected; this is a transparency and maintenance gap rather than evidence of an unsafe release.

Security policy

The repository has no security policy, leaving vulnerability reporting and maintenance expectations less clear for a payment SDK.

Workflow audit

Both workflows were analyzed successfully and have no untrusted checkouts or script injection, but all five action references are unpinned and a high-confidence audit found an unpinned container image. The low-confidence cache-poisoning finding is only a hygiene concern.