yuxiaoyang/yfbwappay

The MIT declaration and setup documentation help consumers get started, but the payment code shows little evidence of ongoing review or maintenance. The small project also lacks a security process and includes a private-key file in its published tree, increasing reliance risk.

Latest 1.0

Packagist

40%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

This package has only one release, published 9 years ago, with no releases in the last 12 months. That strongly suggests abandonment risk for a payment integration.

Repo commit activity

The repository recorded no commits or active maintainers in the last 3 months, and its last push was in March 2020. The non-archived status does not compensate for this prolonged inactivity.

Package file tree

The nine-file package tree includes rsa_private_key.pem alongside payment code. Even without inspecting its contents, publishing a private-key-named file is a serious transparency and operational concern.

Repo popularity

The repository has only 3 stars, 0 forks, and 1 watcher. Popularity is supporting evidence rather than a verdict, but these counts provide little evidence of broad review or community support.

Security policy

The linked repository has no security policy or documented security reporting process. That is a meaningful gap for a package handling payment credentials and signatures.