getpop/api-clients

This is a healthy, actively maintained release with a five-year history, 163 releases, 33 releases in the last 12 months, a stable non-prerelease version, and a repository that was updated very recently. The package is licensed, has tests in both the artifact and repository, uses Composer without install-time lifecycle scripts, has a small dependency surface, and is clearly tied to an organization-owned repository that names and documents the package. The main risks are concentrated maintenance in one contributor, limited repository popularity, and the absence of repository security scanning and a formal security policy; these warrant some operational caution but do not outweigh the strong release and maintenance evidence.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

100

Health Score Breakdown

Repo bus factor

One contributor made all 15 commits in the last three months, creating a genuine bus-factor and continuity risk. Organization ownership partly mitigates handoff risk but does not eliminate the current contributor concentration.

Repo popularity

The repository has only 2 stars, 0 forks, and 1 watcher, indicating limited external adoption or visibility. Popularity is supporting evidence rather than a decisive health criterion, so this is a minor caution.

Repo tooling

Composer is used as a build tool, but no security scanning tools are configured. This is a transparency and assurance gap, though it is not evidence of unsafe behavior by itself.