udir-moodle/atto_multilang2

Release historycaution

Only one release is recorded, published 96 days ago, so there is little release history to demonstrate sustained maintenance or compatibility work.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, which weakens evidence of ongoing maintenance after publication.

Repo toolingcaution

Composer and Phing build tooling are present, but no security scanning tooling was detected, leaving a modest transparency and hygiene gap.

Security policycaution

The repository has no security policy, reducing clarity about vulnerability reporting and response for a package intended for Moodle deployments.

Workflow auditcaution

The only workflow gives top-level write permissions and uses both actions without pinning, while the high-confidence template-injection finding is hygiene rather than a demonstrated dangerous trigger-and-sink path.