udir-moodle/antivirus_mimeblocker

Licensecaution

The manifest declares GPL-3.0-or-later, while the artifact license file is detected as AGPL-3.0; the release is licensed, but the mismatch reduces transparency.

Release historycaution

Only one release is recorded, with no established release cadence; this may reflect a newly mirrored package, but it provides little evidence of release maturity.

Repo commit activitycaution

The repository has no commits and no active maintainers in the last 3 months, leaving current maintenance capacity un demonstrated.

Security policycaution

No repository security policy is present, which weakens vulnerability-reporting transparency for a plugin that handles uploaded files.

Workflow auditcaution

The sole workflow gives top-level write permissions and both action references are unpinned. A high-confidence template-injection finding is present, but there is no untrusted trigger or checkout count tying it to an exploitable path, so this remains a hygiene concern rather than a severe risk.