w8tcha/ckeditor-wordcount-plugin

Dangerous workflowscaution

The release workflow uses an untrusted checkout in a workflow-run context, which warrants review of workflow permissions and inputs. No pull_request_target or script-injection patterns were detected, limiting the severity.

Maintainerscaution

Only one registry account has publish access. This is a meaningful operational single point of failure, and the repository is user-owned rather than organization-owned, so there is no organization backing to compensate for the concentration.

Package scaffoldingcaution

A substantial README and GitHub Releases provide useful documentation and release transparency, but neither the artifact nor repository contains tests or a changelog. For a small CKEditor plugin this is a hygiene gap, though not an immediate dependency blocker.

Project backingcaution

The source repository is owned by the individual user w8tcha rather than an organization, so there is no observed institutional backing to offset the single-maintainer risk.

Repo bus factorcaution

All three recent commits came from one contributor, giving the project a bus factor of one. Because the repository owner is an individual, this concentration is not compensated by organizational backing.