strapi-plugin-magic-mail

Dependency profilecaution

Seventeen runtime dependencies support a feature-rich email and messaging plugin, but the relatively broad dependency surface adds maintenance and update exposure.

Repo bus factorcaution

Two contributors were active, but the main contributor made 82.8% of commits. Because the repository is user-owned rather than organization-owned, this concentration leaves meaningful continuity risk.

Repo toolingcaution

The project uses npm scripts and esbuild, but no security-scanning tools were detected. That is a modest transparency and maintenance gap for a plugin handling email credentials and integrations.

Security policycaution

The repository has no security policy. For a plugin handling email accounts, OAuth, and messaging credentials, the lack of a documented vulnerability-reporting path is a real hygiene gap.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkout or script-injection findings, and it scopes permissions at job level. However, both action references are unpinned and the audit found a high-confidence low-severity ad hoc package installation, weakening build reproducibility.