openeuropa/oe_contact_forms

Dependency profilecaution

The release declares eight runtime dependencies, including Drupal core and related modules. This is a meaningful integration surface but remains plausible for the documented Drupal module.

Lifecycle scriptscaution

Composer post-install and post-update scripts run during dependency operations. Such hooks add some supply-chain and installation complexity, although their presence alone does not show unsafe behavior.

Repo bus factorcaution

All 3 recent commits came from one contributor, giving the repository a concentrated short-term bus factor. Organization backing partly offsets this, but succession risk remains.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. This is a transparency and hygiene gap rather than evidence of an unsafe release.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency for a module handling contact messages, although other project documentation and tests provide some compensation.