extcode/cart-books

Repo bus factorcaution

All five commits in the last three months came from one contributor, giving the project a concentrated maintenance base. The two registry maintainers provide some publishing continuity but do not demonstrate broader repository activity.

Security policycaution

The linked repository has no security policy. For an extension handling shopping-cart and order functionality, this is a transparency and vulnerability-reporting gap.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkout or script-injection findings, and it has no top-level write permissions. However, all 11 action references are unpinned, leaving build inputs less reproducible.