It has one publisher, no security policy, and declares a proprietary license, which limits transparency and adoption confidence. The repository is linked and the release is stable, but those positives do not offset the maintenance gap.
43%
Total Score
25
67
75
The latest release was published over three years ago, and there have been no releases in the last 12 months. Only three releases exist overall, indicating limited ongoing maintenance.
The repository had no commits and no active maintainers in the last three months, consistent with the release history showing no activity for over three years.
The package declares a proprietary license, so it is licensed, but the terms are less transparent and less suitable for an open-source dependency than a recognized open-source license.
Only one registry account has publish access, leaving the package dependent on a single publisher. The repository is user-owned rather than organization-backed, so there is no shown maintainer redundancy.
A README is present and the stable release has a GitHub release record, which supports basic consumer documentation. The README is only 13 characters and no tests or changelog were detected, so transparency remains limited.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
alibabacloud/dysmsapi-20170525 Version 2.0.20 | — | — |
tencentcloud/tencentcloud-sdk-php Version ^3.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.