@wordpress/url

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is present, reducing release transparency even though the package has strong independent maintenance evidence.

Maintainerscaution

The package has 25 publish-access accounts and is organization-backed, but many accounts use outside domains, including riad, whyisjake, sirreal, nosolosw, ntsekouras, desrosj, and mamaduka; this is an account-hygiene concern rather than evidence of weak maintenance capacity.

Repo package mentioncaution

The linked repository name does not match @wordpress/url and its README does not mention the package, leaving some uncertainty about package-to-repository identity; the mismatch is also consistent with a monorepo subpackage.

Workflow auditcaution

All 27 workflows were analyzed, 150 of 150 action references are pinned, and 26 workflows use read-only permissions. Three high-confidence template-injection findings are hygiene concerns, while the low-confidence environment and cache findings and one ad hoc package install add limited caution.