b13/twoclickmedia

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, which is a meaningful maintenance concern despite the repository having been pushed recently and the package having a recent release.

Repo popularitycaution

The repository has only 2 stars and 5 forks, so public adoption appears limited. This is supporting caution rather than a decisive health problem because the project is organization-backed and maintained.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy, making the process for reporting and handling vulnerabilities unclear.

Workflow auditcaution

The single workflow was fully analyzed and has no untrusted checkout or script-injection trigger, but both action references are unpinned and the audit found a high-confidence template-injection issue. These are CI hygiene and supply-chain concerns, not evidence that the package itself is malicious.