@automattic/newspack-blocks

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less independently verifiable.

Licensecaution

The manifest declares GPL-2.0-or-later, while the artifact license file was detected as MIT; the repository also contains a license file, but the conflicting artifact evidence needs clarification.

Maintainerscaution

The package has clear organization backing through Automattic and 18 publish accounts on its primary domain. The outside-domain accounts include blowery, ehg_, sgomes, sirbrillig, chriszarate, jeherve, wwa, newspack-npm, mrmurphy, wpvip-bot, alshakero, mehmoodak, simison, fredrikekelund, oandregal, _mirka_, and aduth, creating account-hygiene exposure despite the organizational base.

Security policycaution

The repository has no published security policy, reducing transparency for vulnerability reporting and response.

Workflow auditcaution

All 17 workflows were analyzed, but one pull_request_target workflow performs an untrusted checkout, seven workflows grant top-level write permissions, 36 of 53 action references are unpinned, and high-confidence template-injection and bot-condition findings remain. The cache-poisoning findings are low confidence and therefore add little weight.