Why can some plugins not be installed?

e.g. the NerdFont Icon Picker can no longer be installed. why?

On the website the install-button is grey and not clickable…

community.obsidian.md/plugins/nerdfont-icon-picker

The plugin was removed from obsidianmd/obsidian-releases in the following commit 089b29c…

Since the plugin was removed from the community plugins list, that may be why installation no longer works, though the removal reason is still unclear

Probably due to its use of "file-entry-cache": "^8.0.0", and the recent key supply chain attack 500 million odd downloads compromised.

See NPM Malware Compromises keyv and cacheable with 500M+ Weekly Downloads and Spreads to Hundreds of Packages

This is my hunch

I don’t have the specifics but from what I’ve observed (and seen/read on Obsidian Discord server), sometimes, a plugin (and potentially a theme ?) can be “removed” from the community directory after a new release (possibly while or after the automatic review is running) :blush: …
If the automatic review goes well, the plugin is re-added later on… and once available again in the Community Directory, it can again take some time afterwards for the plugin to be available in Obsidian’s in-app plugin browser …

There was a new release of that plugin 2 days ago and it seems like it’s now available again from the community directory and Obsidian’s in-app browser…

After that though, it’s scorecard looks a bit strange though :woman_shrugging: …

I see what you mean. It does look a bit strange

When I had a look, serendipity struck, and I bump into Ferusnet Security Audit - Obsidian Plugin

I wonder how the plugin ecosystem will evolve as this must be a headache for the Obsidian team

FWIW: I ended up asking on Discord and it turns out that the automatic review in this specific case, ran out of resources (and couldn’t finish the scan) :sweat_smile: …
NerdFont Icon Picker was re-scanned and it now has a proper scorecard :blush: