AUTOMATED Marketplace extensions have vendor support evidence

Why it Matters

Some Magento extensions may still function but the vendor has stopped providing support — no security advisories, no patch releases, and no response to issues. Using unsupported extensions leaves the store vulnerable because any new vulnerabilities will remain unpatched forever.

Flagging extensions with no vendor support ensures store owners can plan to replace or remove them before they become long-term security liabilities.

Verification Steps

composer show vendor/extension -a
# Check "abandoned" flag or lack of recent releases

Remediation / Fix Guidance

1. Maintain an inventory of installed extensions with vendor info and last update date.
2. If an extension is unsupported:
   • Plan migration to a maintained alternative.
   • Consider removing the feature entirely if not business-critical.
   • If unavoidable, fork the code and maintain security patches internally.
3. Update procurement policies to forbid installing extensions without active vendor support.

Examples

References

• OWASP Top 10 — A06: Vulnerable and Outdated Components
• OWASP — Dependency-Check