function readOnly(count){ }
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
+ Start a Discussion
Chinu_SFDCChinu_SFDC 

query on Salesforce Packages ? please help

Can admin from Client Prod/ Sandbox org create unmanaged package and install in their own Developer org  ?
If they can do it, then the client code is compromised ? Is it correct ?
SwethaSwetha (Salesforce Developers) 
HI Chinu. 
Short answer- Yes.

>Unmanaged packages are typically used to distribute open-source projects or application templates to provide developers with the basic building blocks for an application. 

>Unmanaged packages are useful for resources that only require a “one-time delivery” to an org, such as templates, code samples, or metadata.

>Once installed, the package source code can be viewed by its recipients and modified freely, and it bears no remaining connections to the org where it originated.

>As such, the only way an unmanaged package can be modified, patched, or updated is if it’s edited directly, or if it’s uninstalled and replaced by a new copy of the package.

>The subscribers however cannot distribute the unmanaged package.The unmanaged package needs to be Converted to a managed package fo through the security review process.

See https://salesforce.stackexchange.com/questions/116209/how-to-host-an-unmanaged-package-on-salesforce-appexchange

Note: This is not just the case with using the unmanaged package, but even with IDEs like VisualStudioCode , Eclipse, migration tools like ANT, Workbench, the org's metadata can be copied.

In case of unmanaged, you can check if it is created from the setup>Packages

If this information helps, please mark the answer as best.Thank you