middag-io/wordpress

Lifecycle scriptscaution

The package defines post-install and post-update Composer scripts, which execute during dependency operations and increase installation trust requirements. No provided signal shows those scripts are unsafe, so this is a moderate caution rather than a severe risk.

Repo bus factorcaution

One contributor made 100% of the 105 commits during the last three months. The organization-owned project provides some backing, but no second active contributor is shown, leaving a meaningful continuity risk.

Repo toolingcaution

Composer build tooling is present, but no repository security-scanning tools were detected. The missing scanning is a hygiene limitation rather than evidence of abandonment.

Workflow auditcaution

Both workflows were analyzed with no detected audit findings or untrusted checkouts, but all 11 action references are unpinned and one workflow has top-level write permissions. The workflow_run trigger is ordinary here because no dangerous sink was found.