craigiswayne/wp-shanela

Maintainerscaution

One registry account publishes the package, which gives it a thin publishing base. The linked repository is owned by the same individual, so this is a modest resilience concern rather than evidence of abandonment by itself.

Release historycaution

Only two releases have been published, and the latest was on April 4, 2024; there have been no releases in the last 12 months. This indicates materially slowed maintenance for a package that may need compatibility updates.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the release gap. The repository is not archived, but current development activity is absent.

Security policycaution

The linked repository has no security policy. For a small Composer automation package this is a transparency gap, though it is less severe than an archived or deprecated project.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts, script injection, or audit findings. However, it grants top-level write permissions and all four action references are unpinned, creating avoidable workflow maintenance and supply-chain hygiene weaknesses without a demonstrated exploit path.