outstand/carousel

Release historycaution

Five releases appeared within about 11 hours, so the package has very limited long-term release history. That limits maturity evidence but does not indicate abandonment.

Repo commit activitycaution

There were no commits or active maintainers recorded over the last three months, but the package and repository are only hours old, so this is insufficient history rather than clear inactivity.

Security policycaution

The repository has no published security policy. This is a transparency gap for a package that ships executable WordPress and JavaScript code, though it is not evidence of unsafe behavior by itself.

Workflow auditcaution

The only workflow was fully analyzed and has no dangerous triggers, untrusted checkouts, script injection, or audit findings, with job-level permissions. Its one action is unpinned, leaving a modest reproducibility and action-integrity gap.