inc2734/wp-oembed-blog-card

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. This is a meaningful sign of currently quiet maintenance, although recent releases provide some compensating evidence.

Repo popularitycaution

The repository has only 2 stars, 1 fork, and no watchers. Low popularity is supporting evidence of a small project, not by itself a reason to reject a stable package.

Security policycaution

The repository has no security policy. This reduces transparency for reporting and handling vulnerabilities, though it does not establish that the package is unsafe.

Workflow auditcaution

All four analyzed action references are unpinned, which weakens build reproducibility. The reported cache-poisoning findings have low confidence and therefore remain hygiene concerns rather than severe risks; the audit itself was complete and found no untrusted checkout or script-injection paths.