wula/aliyun

Release historydanger

This package has only one release, published about 8 years ago, with no releases in the last 12 months. That strongly indicates abandonment risk for a dependency.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last 3 months, consistent with the package's long-standing inactivity and leaving maintenance capacity unproven.

Licensecaution

The manifest declares Apache-2.0, but the detected LICENSE file is MIT. Although a license file exists, the mismatch creates uncertainty about the terms governing this release.

Repo package mentioncaution

The linked repository name does not match the package name, and no README package mention was collected. This leaves some uncertainty about whether the repository is the package's intended source.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected. This is a modest supply-chain hygiene gap rather than evidence that the release is unsafe.