lwplugins/lw-scan

Release historycaution

The package has four releases in about 12 hours, with a median interval of about 1 hour. This shows active initial publishing but provides no longer-term maintenance record.

Repo commit activitycaution

The repository shows zero commits and zero active maintainers over the last three months. Because the package and repository are only about a day old, this is mainly an unproven maintenance record rather than strong abandonment evidence.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected. This is a modest transparency and hygiene gap.

Security policycaution

The repository has no security policy. For a WordPress malware-scanning tool, the missing disclosure process is a meaningful transparency gap.

Workflow auditcaution

Both workflows were analyzed successfully with no dangerous audit findings or untrusted triggers, and one scopes permissions at job level. However, all 11 action uses are unpinned, leaving workflow dependencies exposed to tag or ref changes.