automattic/liveblog

Name lookalikedanger

The package is flagged as borrowing the identity of automattic/vipwpcs, a much more downloaded package owned by another publisher. Although artifact overlap is 0.0 and the README does not identify it as that package, the identity signal is a severe adoption risk.

Security policycaution

The repository has no published security policy, leaving reporting and response expectations less transparent despite release notes documenting a recent security fix.

Workflow auditcaution

All 7 workflows were analyzed, use read-only permissions, and pin all 22 action references. One high-confidence low-severity finding installs a package outside a lockfile, which is a limited hygiene concern.