straschek-io/typo3-tor-blocker

Release historycaution

The package is brand new, with two releases published within the same day and no established release track record. This limits evidence of long-term maintenance and compatibility.

Repo bus factorcaution

All eight recent commits came from one contributor, so maintenance depends entirely on a single person and has limited handoff resilience.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a transparency gap, though it is not evidence of a vulnerability by itself.

Workflow auditcaution

Both workflows were analyzed completely and use no untrusted checkout or script-injection trigger, but all six action references are unpinned and the publishing workflow has two high-confidence template-injection findings. These are workflow hygiene and release-integrity concerns even without a dangerous trigger.