andrewmead/wpsites

Lifecycle scriptscaution

A post-install-cmd script runs during installation, adding execution during dependency setup. This is a supply-chain hygiene concern, though the signal alone does not show harmful behavior.

Project backingcaution

The repository is owned by an individual user rather than an organization. This is not inherently unhealthy, but it means the concentrated contributor activity carries more weight.

Repo bus factorcaution

One contributor made all two commits in the last three months, giving the project a complete short-term concentration of maintenance responsibility. The repository is user-owned rather than organization-owned, so there is no provided organizational backing to offset this.

Repo commit activitycaution

Only two commits were recorded in the last three months, indicating limited recent development activity despite the recent release.

Repo toolingcaution

Composer and Box provide build tooling, but no security-scanning tools were detected, leaving automated security coverage unestablished.