getpop/engine-wp

This is a generally healthy and actively maintained release: the package has existed since 2021, has 162 releases including 33 in the last 12 months, is stable, is not deprecated, and was pushed very recently. It has clear licensing, tests, a README, Composer build tooling, no install-time scripts, and a repository that matches the package and is backed by an organization. The main concerns are maintenance concentration—one contributor made all 14 commits in the last 3 months—limited repository popularity, no security scanning or repository security policy, and no changelog. These are meaningful transparency and resilience gaps, but the strong release cadence and recent activity make the package reasonable to depend on with normal review of updates.

Latest 19.2.4

Packagist

80%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account has publish access, which is a resilience concern in isolation. However, the linked repository is organization-owned and shows recent activity, so this is a caution rather than a severe risk.

Repo bus factor

All 14 recent commits came from one contributor, creating a genuine bus-factor concern. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo issue activity

There were no new issues or pull requests in the last month and no merged pull requests; this shows little recent community activity, although it does not by itself establish abandonment.

Repo popularity

The repository has only 2 stars, 1 fork, and 1 watcher, indicating limited external adoption or visibility. Popularity is supporting evidence rather than decisive, so this lowers confidence more than it determines health.

Repo tooling

Composer build tooling is present, but no security scanning tools are detected. The build setup is positive while the missing security automation is a modest hygiene gap.