humanmade/hm-external-links

Release historycaution

This is a young package, about 120 days old, with only one release and no established release cadence. That limits evidence of sustained maintenance but does not indicate abandonment by itself.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. Because the project is young and was pushed on the release date, this is a maintenance concern rather than severe abandonment evidence.

Repo toolingcaution

The repository uses Composer, but no security-scanning tool was detected. This weakens supply-chain transparency somewhat, while the presence of a defined build tool provides limited compensation.

Security policycaution

No repository security policy was found. For a small plugin this is not evidence of unsafe code, but it reduces transparency about vulnerability reporting and maintenance expectations.

Workflow auditcaution

Both workflows were analyzed successfully and all three action references are pinned, with no untrusted checkouts or script-injection findings. However, the release workflow has six high-confidence template-injection findings, which is a meaningful workflow-hygiene concern even without a dangerous trigger or sink corroborating it.