felixnagel/pluploadfe

Repo bus factorcaution

All three recent commits came from one contributor, leaving maintenance concentrated in a single person and increasing continuity risk.

Repo commit activitycaution

Three commits in the last three months show recent activity, but the volume is modest and does not demonstrate a broad maintenance effort.

Security policycaution

The repository has no security policy, which leaves vulnerability reporting and response expectations undocumented for a package handling uploads.

Workflow auditcaution

Both analyzed action references are unpinned, and the release workflow contains high-confidence template-injection findings; without an untrusted trigger these are workflow hygiene concerns rather than a standalone severe verdict.