vinkla/wordplate

Lifecycle scriptscaution

The package runs a post-root-package-install script. This is an install-time behavior that deserves awareness, but the provided signal does not show harmful or unusually broad actions.

Repo bus factorcaution

One contributor made all 5 commits in the last 3 months, giving the repository a 100% top-contributor share. As a user-owned project rather than an organization-owned repository, this concentration is a meaningful resilience concern.

Repo commit activitycaution

There were 5 commits in the last 3 months and 1 active maintainer, showing recent work but a narrow maintenance base. The activity is positive, while the concentration adds some abandonment risk.

Security policycaution

The repository has no security policy. For a WordPress boilerplate handling application dependencies and configuration, this reduces the clarity of vulnerability-reporting expectations.

Workflow auditcaution

All workflows were analyzed with no reported audit findings, no untrusted checkouts, and no script injection. However, both referenced actions are unpinned, leaving a minor reproducibility and action-supply-chain hygiene gap.