This release is actively published and backed by a non-archived organization repository, with a stable version, substantial release history, an explicit GPL license, tests, and no install-time lifecycle scripts. However, the package is explicitly marked abandoned on Packagist and has a replacement package, which is a severe adoption risk: dependents should migrate to the replacement rather than start using this name. Maintenance is also concentrated in one contributor, and the linked repository neither matches the package name nor mentions it in its README, reducing confidence that the repository is the authoritative home for this package. The package is therefore unhealthy to adopt despite evidence of ongoing related project activity.
28%
Total Score
67
100
72
88
Packagist marks the package as abandoned and identifies getpop/custompostmedia-wp as its replacement. This is a severe compatibility and maintenance risk for new dependents.
One contributor made 100% of the 14 recent commits. The organization-owned repository provides some ability to hand off maintenance, but no second active contributor is shown, so concentration remains a concern.
The repository recorded 14 commits in the last 3 months, showing active work, although all activity came from one maintainer.
The repository name does not match the package name and the README does not mention the package. This raises concern that the linked repository may not be the authoritative home for this exact package.
The repository has 1 star, 0 forks, and 1 watcher. Popularity is only supporting evidence, but these very low counters provide little external validation.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
pop-cms-schema/media-wp Version ^19.2.4 | — | — |
pop-cms-schema/customposts-wp Version ^19.2.4 | — | — |
pop-cms-schema/custompostmedia Version ^19.2.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.