automattic/jetpack-videopress-core

Repo popularitycaution

The repository has only 3 stars and 2 forks, providing little community validation, though popularity is supporting evidence and the active organization-backed project compensates for this gap.

Repo toolingcaution

Composer is used for builds, but no repository security-scanning tools were detected, leaving a modest security-process gap.

Version stabilitycaution

The assessed version is not a prerelease, although the package remains below major version 1, so its API maturity is less established than a stable-major package.

Workflow auditcaution

Both workflows were analyzed with no untrusted checkouts or script injection and all three action references pinned. The publisher workflow has top-level write access and installs a package outside a lockfile; the low-confidence cache finding is hygiene rather than a severe risk.