jazzman/wp-cli-dotenv-command

Release historycaution

The latest registry release was over five years ago, with no releases in the last 12 months. The package has a substantial release history, but the long pause raises maintenance and compatibility risk.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months. A push in October 2023 shows it is not wholly abandoned, but current maintenance activity is weak.

Security policycaution

The repository has no security policy. That is a transparency gap for reporting vulnerabilities, although it is not by itself evidence that the package is unsafe.

Workflow auditcaution

The single workflow was fully analyzed with no high-confidence audit findings, no untrusted checkouts, and no script-injection sinks. However, both action references are unpinned, leaving a moderate reproducibility and workflow supply-chain hygiene gap.