sympress/wp-cli-console

Release historycaution

The package is young at 99 days, with two releases and a roughly four-day median interval; this shows an initial release effort but not a long maintenance record.

Repo bus factorcaution

All recent commit activity comes from one contributor. The organization-owned repository provides some handoff capacity, but no second active contributor is shown.

Repo commit activitycaution

Only one commit was recorded in the last three months and one maintainer was active, so recent maintenance evidence is thin for a package released about 99 days ago.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected; the repository's separate security policy partly improves transparency but does not replace scanning.

Workflow auditcaution

Both workflows were analyzed without audit findings or untrusted-input sinks, and one workflow uses read-only permissions. However, all four action references are unpinned and one workflow has top-level write permissions, creating a mild reproducibility and token-scope concern.