o-ba/mfa-hotp

Release historycaution

The package has had no release in nearly four years, despite 13 releases overall; this is meaningful abandonment risk for a security-related extension.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap and suggesting maintenance has stopped.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected; this weakens assurance for a package handling multi-factor authentication.

Security policycaution

The linked repository has no security policy, leaving users without a documented channel or process for reporting vulnerabilities in an authentication extension.

Workflow auditcaution

All five analyzed action references are unpinned, and the audit found a high-confidence template-injection issue in the publishing workflow. No untrusted checkout or script-injection trigger was reported, so this is a hygiene concern rather than a severe workflow risk.