
Security News
GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.
CLI to find WordPress plugin opportunities — abandoned, low-rated, or poorly-supported plugins with large user bases you could replace. Powered by wpgoldmine.io.
A command-line tool to find WordPress plugin opportunities — large, established plugins weakened by abandonment, low ratings, or poor support, i.e. plugins you could realistically replace or out-build. Powered by wpgoldmine.io; querying runs server-side, so there's nothing to install but the CLI itself.
npx wpgoldmine search --preset abandoned-plugins --niche forms
Or install globally:
npm install -g wpgoldmine
wpgoldmine presets
wpgoldmine presets List the curated opportunity presets.
wpgoldmine search [options] Find ranked plugin opportunities.
wpgoldmine plugin <slug> Opportunity snapshot for one plugin.
search options| Option | Description |
|---|---|
--preset <key> | Curated angle, e.g. abandoned-plugins, low-rated-popular, beatable-niche. Composes with --niche. |
--niche <tag> | Narrow to a WordPress.org tag, e.g. seo, forms, backup. |
--ecosystem <name> | wordpress (default) or woocommerce. |
--min-installs <n> / --max-installs <n> | Active-install bounds. |
--max-rating <r> | Max rating on a 0–100 scale (lower = more dissatisfied users). |
| Option | Description |
|---|---|
--json | Print raw JSON for scripting / CI. Pipe to jq. |
--base <url> | Override API base (default https://wpgoldmine.io, or $WPGOLDMINE_API_BASE). |
-h, --help / -v, --version | Help / version. |
Set WPGOLDMINE_API_KEY (a WP Goldmine account token, from your account settings) to raise the result
limit and unlock extra fields. Without it, the CLI uses the free, capped tier.
export WPGOLDMINE_API_KEY=wpg_your_token_here
wpgoldmine search --preset abandoned-plugins --niche forms --limit 100
# Abandoned plugins in a specific niche
wpgoldmine search --preset abandoned-plugins --niche forms
# Mid-size, low-rated plugins (proven demand, poor execution)
wpgoldmine search --min-installs 10000 --max-installs 50000 --max-rating 60
# One plugin's opportunity snapshot
wpgoldmine plugin easy-google-fonts
# Scripting: list slugs of low-rated popular plugins
wpgoldmine search --preset low-rated-popular --json | jq -r '.data[].slug'
Because --json is machine-readable, you can wire wpgoldmine into a scheduled job to watch a niche:
wpgoldmine search --preset newest-opportunities --niche ai --json > opportunities.json
This repo also ships a GitHub Action, so you can run the same queries in a workflow without managing Node yourself.
- id: opportunities
uses: Bishop81/wpgoldmine-cli@v1
with:
args: search --preset abandoned-plugins --niche forms
output-file: opportunities.json
- run: cat opportunities.json | jq '.data[0]'
| Input | Default | Description |
|---|---|---|
args | presets | Arguments for the CLI, e.g. search --preset abandoned-plugins --niche forms. |
json | true | Append --json for machine-readable output. |
api-base | (prod) | Override the API base (WPGOLDMINE_API_BASE). |
output-file | (none) | Also write the output to this path. |
The step output result holds the CLI stdout. A full scheduled example is in
examples/watch-niche.yml.
MIT
FAQs
CLI to find WordPress plugin opportunities — abandoned, low-rated, or poorly-supported plugins with large user bases you could replace. Powered by wpgoldmine.io.
The npm package wpgoldmine receives a total of 5 weekly downloads. As such, wpgoldmine popularity was classified as not popular.
We found that wpgoldmine demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.

Research
/Security News
A Twitch browser extension on Chrome and Firefox forwards users’ live OAuth session tokens through proxies controlled by a Russian bot service.