inc2734/wp-profile-box

Release historycaution

The package has 17 releases since September 2017, but none in the last 12 months and the latest release was in November 2024, indicating a meaningful maintenance slowdown.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. The stable package story partly reduces the concern, but current maintenance capacity is not demonstrated.

Security policycaution

The repository has no security policy, reducing transparency for reporting and handling security issues. This is a hygiene concern rather than evidence that the package is unsafe.

Workflow auditcaution

All three workflow actions are unpinned, but the only reported findings are low-confidence cache-poisoning patterns; the workflow has no untrusted checkout or script-injection findings, so this remains limited hygiene risk.