wp-content-framework/custom_post

Release historydanger

The package has 79 releases since January 2019, but none in the last 12 months; its latest release was in December 2020, nearly six years ago. This is strong evidence of abandonment risk.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the release history's prolonged inactivity.

Workflow auditdanger

One pull_request_target workflow checks out untrusted content, and the audit reports a high-confidence unpinned container image plus all 48 action references unpinned. Low-confidence GITHUB_ENV and archived-action findings add workflow hygiene concerns.

Licensecaution

The release includes a license file and repository license, but the artifact is detected as GPL-3.0 while the registry declares GPL-2.0+, creating a license compatibility and transparency concern.

Security policycaution

The linked repository has no security policy, leaving vulnerability reporting and response expectations undocumented.