de-swebhosting-typo3-extension/mediaoembed

Lifecycle scriptscaution

The package runs a post-autoload-dump script during installation. This is a mild operational consideration, but the provided signal does not show that the script is unsafe or unusually invasive.

Repo bus factorcaution

One contributor made all six commits in the last three months, leaving maintenance highly concentrated. Because the repository owner is an individual, there is no organization backing shown to offset this dependency.

Repo toolingcaution

The project uses Composer for builds, but no security scanning tool was detected. This is a modest transparency and maintenance gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy. That reduces transparency for reporting and handling vulnerabilities, although it does not by itself indicate that the release is unsafe to adopt.

Workflow auditcaution

Both analyzed workflows completed the audit without high-confidence findings or untrusted checkout and script-injection paths. However, all three referenced actions are unpinned, which weakens build reproducibility and supply-chain hygiene.