yaleksandr89/oauth2-yandex
The package has clear documentation, tests, a security policy, and active recent releases. Its workflow scopes permissions read-only, but all seven action references are unpinned, leaving avoidable build-reproducibility risk.
68%
Total Score
75
100
100
83
Health Score Breakdown
The package and repository are owned by the same individual account, so the observed single-person maintenance pattern is not backed by an organization handoff structure.
One contributor made all 16 commits in the last 3 months, concentrating maintenance knowledge and creating a meaningful continuity risk.
The sole workflow was fully analyzed, uses read-only permissions, and has no untrusted checkout, script-injection, or high-confidence audit findings. However, all 7 of 7 action references are unpinned, so workflow inputs are not fully reproducible.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Александр Юрченко |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 psr/http-message Version ^1.1 || ^2.0 | — | — |
league/oauth2-client Version ^2.9 | — | — |
Weekly Downloads
Info
- Last Published
- 3 days ago
- Created
- 1 month ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.