frosty-media/wp-tally

Release historycaution

The package has had no release in the last 12 months, despite 13 releases since May 2025. This is a meaningful maintenance concern for a dependency, though the recent repository push provides some compensating evidence.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, indicating currently inactive development. The May 2026 push and organization backing partly offset, but do not remove, this concern.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and disclosure expectations undocumented. This is a modest transparency gap.

Workflow auditcaution

All 9 analyzed action references are unpinned, which weakens build reproducibility, and the audit found high-confidence template-injection patterns in publish.yml. The template findings are hygiene concerns here because no untrusted trigger or checkout sink was reported.