pop-api/api-endpoints

This is a healthy, actively maintained release with a history dating back to 2021, 163 releases, and 33 releases in the last 12 months, including a stable non-prerelease version. The package is not deprecated, is backed by an active organization-owned repository, includes its license, tests, and a complete small source tree, and has no install-time lifecycle scripts. The main concerns are that all 14 commits in the last 3 months came from one contributor, the repository has no security scanning or security policy, and the repository has very low public popularity; these are meaningful resilience and transparency gaps but do not outweigh the strong release and repository activity.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account has publish access, which is a resilience concern; however, the repository is organization-owned and shows ongoing release activity, partly mitigating the narrow publishing base.

Repo bus factor

One contributor made 100% of the 14 recent commits, creating a low bus factor and dependence on a single maintainer; organization ownership provides some potential handoff capacity but no second active contributor is evidenced.

Repo issue activity

There were no new or merged pull requests and no new or closed issues in the last month; this does not prove abandonment because release and commit activity remain strong, but it limits evidence of broader issue engagement.

Repo popularity

The repository has only 1 star and no forks, so there is little external adoption evidence. Popularity is supporting evidence rather than a decisive health criterion, so this is a caution rather than a severe risk.

Repo tooling

Composer is used as a build tool, but no security scanning tools are configured, leaving a security-hygiene gap.