pop-api/api-graphql

This is a mature, actively released and currently maintained package: it has 163 releases over roughly 5 years, 33 releases in the last 12 months, a stable non-prerelease version, and a repository pushed on the assessment date. The package is licensed, includes a README and tests in both the artifact and repository, has a small runtime dependency profile, and has no install lifecycle scripts or registry deprecation. The main concerns are that all 14 commits in the last 3 months came from one contributor, the repository has very low popularity, and it has no security policy or security-scanning tooling; these reduce resilience and transparency but do not outweigh the strong release and maintenance evidence, particularly with organization ownership and package-repository alignment.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account has publish access. This is a limited publishing base, but the repository is owned by an organization and release activity is strong, so it is a resilience concern rather than a severe health risk.

Repo bus factor

One contributor made all 14 commits in the last 3 months, creating a genuine continuity risk. Organization ownership offers some potential handoff capacity, but no second active contributor is shown by this signal.

Repo popularity

The repository has only 3 stars, 0 forks, and 1 watcher. Low popularity is not decisive for a specialized package, but it provides little supporting evidence of broad external adoption.

Repo tooling

Composer is used as the build tool, but no security-scanning tools are detected. Build tooling is appropriate, while the missing scanning is a modest security-hygiene gap.

Security policy

No repository security policy was found, reducing vulnerability-reporting transparency. This is a hygiene concern, not evidence that the package is unsafe or abandoned.