typisttech/wordfence-api

The package is clearly identified, licensed, tested in its repository, and has no install-time scripts. Workflow permissions and fully unpinned actions add avoidable maintenance and supply-chain hygiene concerns.

Latest v0.2.0

Packagist

65%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has five releases over about 653 days, but only one release in the last 12 months; this indicates a modest and slowing release cadence for a 0.x package.

Repo commit activity

There were no commits and no active maintainers in the last three months, which is a maintenance concern, although the repository was pushed recently and pull requests are being merged.

Security policy

No repository security policy was found, reducing transparency for reporting vulnerabilities in a package that consumes vulnerability-feed data.

Version stability

Version 0.2.0 is a stable release rather than a prerelease, but the package remains below 1.0, so its API may still change materially.

Workflow audit

All six workflows were analyzed, but all 16 action references are unpinned and two workflows grant top-level write access. The high-severity cache-poisoning finding has low confidence and is hygiene-level, while high-confidence secrets inheritance warrants caution.