Finding the upstream for mendexk

Hi all,

I recently discovered an off-by-one out-of-bounds memory read in
mendexk and upmendex. While I found
https://github.com/t-tk/upmendex-package as the upmendex upstream
through CTAN, I have not had luck finding the corresponding mendexk
upstream. Where should I send my patch for the mendexk issue?

Thanks,

Ryan