udir-moodle/local_quicknote

Release historycaution

Only four releases appeared within minutes on the collection date, so this release has not yet demonstrated sustained maintenance or a dependable release cadence.

Repo commit activitycaution

The repository shows zero commits and zero active maintainers in the last three months, but the package is newly published, so this is limited evidence rather than proof of abandonment.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected, leaving a modest transparency and maintenance gap for a package with executable code.

Security policycaution

The linked repository has no security policy, reducing clarity about how vulnerabilities should be reported and handled.

Workflow auditcaution

The single workflow gives all workflows top-level write access, leaves both action references unpinned, and contains a high-confidence template-injection finding. No untrusted checkout or script-injection trigger was detected, so the workflow findings raise caution rather than constituting a standalone severe risk.