magepulse/magento2-module-core

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months. The recent release provides some counterevidence, but the current lack of source activity raises maintenance risk.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were observed. This is a modest transparency and hygiene gap rather than evidence of abandonment.

Security policycaution

The linked repository has no security policy. That weakens vulnerability-reporting transparency, although the package has a README, release notes, and a maintained source repository.

Workflow auditcaution

All 11 action references are unpinned, two workflows grant top-level write permissions, and the audit found a high-confidence unpinned image plus an archived action. No untrusted checkout or script-injection path was found, limiting the risk to workflow hygiene.