@mux/mux-player

Maintainerscaution

Three of four publishing accounts use the organization domain mux.com, which fits the organization-backed project. One consumer-domain account, dylanjha (gmail.com), is a minor account-hygiene caution rather than evidence of weak maintenance capacity.

Security policycaution

The repository has no SECURITY.md policy. This is a transparency gap for vulnerability reporting, though it does not by itself show abandonment or unsafe code.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkouts or script injection, and two scope permissions at job level. However, all 17 action references are unpinned, and the auditor reported a low-confidence cache-poisoning finding; these are workflow-hygiene cautions, not severe evidence on their own.