axepress/wp-graphql-stubs

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts. These add install-time execution risk and deserve review because their behavior is not shown here.

Repo bus factorcaution

All recent commits came from one contributor, leaving maintenance highly concentrated despite the repository being organization-owned.

Repo commit activitycaution

Only two commits were recorded in the last three months, which shows some recent activity but limited maintenance capacity.

Workflow auditcaution

Both workflows were analyzed and all seven action references are pinned, but a high-confidence template-injection finding remains in the release workflow; without an untrusted trigger or checkout it is a hygiene concern rather than a standalone severe risk.