kevinpirnie/kpt-wpfieldframework

Release historycaution

The package is only 159 days old with two releases, separated by about 92 days. That is limited evidence of sustained maintenance, though it is not an abandonment pattern by itself.

Repo bus factorcaution

One contributor made all two commits in the last three months. With user-owned project backing, there is no observed organizational handoff capacity to offset this concentration.

Repo commit activitycaution

Only two commits were recorded in the last three months, from one active maintainer. Recent activity exists but provides limited evidence of maintenance capacity.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency for a framework intended to run inside WordPress applications.

Workflow auditcaution

All six action references are unpinned, which weakens build reproducibility, and the release workflow has three high-confidence template-injection findings. The audit found no untrusted checkout or script-injection sink, so this is workflow hygiene risk rather than a severe standalone verdict.