pop-api/api

This release appears healthy and suitable for dependency consideration: it has a five-year history, 162 releases including 33 in the last 12 months, a stable non-prerelease version, no registry deprecation, an active non-archived repository, and both packaged and repository tests. The main concerns are that all 15 commits in the last three months came from one contributor, the repository has very little visible popularity, and it lacks a security policy and automated security scanning; organization backing and continued release activity reduce, but do not eliminate, the maintenance concentration risk.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one account has registry publish access, which is a concentration concern, although the organization-backed repository and strong release activity provide compensating evidence.

Repo bus factor

One contributor made all 15 commits in the last three months, creating a genuine continuity risk; organization ownership provides some ability to hand off maintenance but does not show a second active contributor.

Repo issue activity

There were no new or closed issues or pull requests in the last month, and no pull requests were open; this provides little evidence of broader community activity, though it is not abandonment evidence given the recent commits and releases.

Repo popularity

The repository has only 2 stars, 0 forks, and 2 watchers, indicating limited external adoption or review; this is supporting caution rather than a health verdict by itself.

Repo tooling

Composer is used as a build tool, but no security scanning tools are present; the missing scanning is a hygiene gap for a dependency package.