getpop/posts-wp

This release shows strong maintenance and packaging evidence: it has a long release history, frequent recent releases, a stable version, an active non-archived organization-owned repository, tests, a license, and no install-time lifecycle scripts. However, Packagist marks the package as abandoned and explicitly provides pop-schema/posts-wp as its replacement; that is a decisive adoption risk because dependents should migrate rather than start using this package. Maintenance is also concentrated in one contributor, and the repository has no security scanning or security policy, but these concerns are secondary to the confirmed deprecation.

Latest 19.2.4

Packagist

22%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Registry deprecation

Packagist marks the package as abandoned via packagist_abandoned and names pop-schema/posts-wp as the replacement. This is a severe dependency risk even though the repository remains active, because new consumers should use the replacement package.

Repo bus factor

One contributor made all 14 commits in the last 3 months, creating a concentrated maintenance dependency. Organizational ownership provides some continuity, but no second active contributor is evidenced.

Repo popularity

The repository has 1 star, 0 forks, and 1 watcher. Low popularity is supporting context rather than a decisive health failure, particularly because the package has active release and commit activity.

Repo tooling

Composer build tooling is present, but no security scanning tools are detected. This is a transparency and assurance gap, not a standalone severe risk.

Security policy

The repository has no SECURITY.md or other detected security policy, leaving vulnerability reporting and response expectations less explicit.