duckdev/wp-review-notice

Registry deprecationdanger

Packagist marks the entire package abandoned and names foxelabs/wp-review-notice as its replacement, making this release unsuitable for a new dependency despite other healthy signals.

Repo bus factorcaution

One contributor made all seven recent commits, leaving maintenance dependent on a single active person even though the repository is organization-owned.

Repo toolingcaution

The project uses Composer build tooling, but no security-scanning tools were detected; this is a modest transparency gap for a dependency project.

Security policycaution

The repository has no security policy, reducing clarity about vulnerability reporting and handling.

Workflow auditcaution

All three workflows were analyzed without high-confidence findings or untrusted execution paths, but all eight action references are unpinned and one workflow grants top-level write access, creating avoidable maintenance and supply-chain hygiene risk.