nailsapp/module-cdn

Registry deprecationdanger

Packagist marks the entire package as abandoned, with no replacement specified. This is a severe adoption risk even though the linked repository remains active.

Release historydanger

This release is the package's only registry release, published about 12 years ago, with no releases in the last 12 months. The repository's recent activity partly offsets abandonment concerns but does not restore release confidence.

Security policycaution

The repository has no security policy. This is a transparency gap for a module handling file upload, manipulation, and storage, though it is not by itself evidence of unsafe code.

Version stabilitycaution

Version 0.1.0 is not a prerelease, but it is an unrevised early version with no subsequent registry releases. That limits evidence of a stable maintained release line.

Workflow auditcaution

All 10 action references are unpinned, weakening build reproducibility, and the audit found two high-confidence template-injection findings. No untrusted checkout or dangerous trigger was reported, so these remain hygiene concerns rather than a standalone severe workflow risk.