morningtrain/wp-economic

Release historycaution

The package has eight releases since January 2024, but none in the last 12 months; the latest release was in August 2025. That limited recent activity is a maintenance concern.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. Although it was pushed more recently, the measured inactivity weakens confidence in ongoing maintenance.

Security policycaution

The linked repository has no security policy. This is a transparency gap for a package that handles API credentials, though dependabot scanning and the documented vulnerability section provide some supporting process.

Workflow auditcaution

All 9 analyzed action references are unpinned, and one workflow has a high-confidence bot-condition finding; three workflows also grant top-level write access. No untrusted checkout or script-injection sink was found, so this is a hygiene concern rather than a severe risk.