alleyinteractive/wp-caper

Lifecycle scriptscaution

The package runs pre-install-cmd and post-install-cmd scripts, increasing install-time execution and review burden even though this alone does not show unsafe behavior.

Release historycaution

The package has four releases since June 2022 and none in the last 12 months; the latest release was about 22 months ago, indicating a quiet maintenance cadence.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, consistent with the long gap since the latest release and raising abandonment risk.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. This is a modest transparency and hygiene gap, not evidence of unsafe code.

Workflow auditcaution

The single workflow was fully analyzed with no reported audit findings or untrusted checkout and script-injection issues. However, all three action references are unpinned, which weakens build reproducibility.