udir-moodle/assignsubmission_onlinepoodll

Release historycaution

The package has only one release in its 98-day history, so there is too little release history to establish mature maintenance. No deprecation signal offsets this, but the package is still relatively new.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months, leaving current maintenance capacity unproven. Its recent push aligns with the sole release, which reduces but does not remove the concern.

Security policycaution

The linked repository has no security policy, reducing transparency about how vulnerabilities should be reported and handled. The organization-owned project provides some backing, but no documented process is shown.

Workflow auditcaution

The only workflow gives top-level write permissions, uses both analyzed actions without pinning, and has a high-confidence template-injection finding. No untrusted checkout or injection trigger was detected, so these are workflow-hygiene concerns rather than a severe standalone risk.