adamjenkins/moodle-block_oerexchangebrowse

Release historycaution

The package is young at 59 days and has six releases, with the latest releases arriving within roughly 3 hours of one another during the initial publishing period. This shows active early iteration but provides little long-term maintenance history.

Repo bus factorcaution

All 17 commits in the last 3 months came from one contributor, leaving maintenance dependent on a single person. The repository is user-owned rather than organization-backed, so there is no provided evidence of an internal handoff path.

Security policycaution

The repository has no security policy, reducing transparency about vulnerability reporting and response expectations. This is a process gap, not evidence that the package is unsafe.

Workflow auditcaution

The audit found three high-confidence template-injection findings in the release workflow, plus all 6 action references are unpinned and one workflow grants top-level write access. No untrusted checkout or script-injection path was found, so this is a meaningful hygiene concern rather than a standalone severe risk.