prestashop/ps_crossselling

Release historycaution

The package has five releases since November 2016, but none in the last 12 months and the median interval is about 826 days. That indicates slow registry publishing, although repository activity shows the project is not abandoned.

Security policycaution

The repository has no security policy. This is a modest transparency gap for an extension project, though Dependabot and active repository maintenance provide some compensating evidence.

Workflow auditcaution

All 19 analyzed action references are unpinned, which weakens build reproducibility. The audit also reports high-confidence template-injection findings, but no untrusted checkout or script-injection trigger was found, so these remain workflow-hygiene concerns rather than a severe dependency risk.