zoujingli/think-plugs-wechat-service

Licensecaution

No declared license, license file, or repository license file was detected. That leaves the legal terms for using this dependency unclear.

Release historycaution

The package has only two releases, with none in the last 12 months and the latest published nearly two years ago. The repository was pushed more recently, which partly offsets the registry inactivity but does not restore release confidence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The recent push timestamp is compensating evidence, but it does not show ongoing development during the measured period.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and maintenance gap rather than evidence that the package is unsafe.

Workflow auditcaution

All three analyzed action references are unpinned, the workflow has top-level write permissions, and the audit found a high-confidence archived action plus ad hoc package installation. The cache-poisoning finding has low confidence, so it adds little weight.