This is a healthy, actively maintained release with a five-year history, 162 releases, 33 releases in the last 12 months, and a latest release published on the assessment date. The package is stable, licensed, non-deprecated, has tests in both the artifact and repository, and is backed by an organization-owned repository that matches the package and documents it. The main risks are concentrated maintenance: one registry maintainer and one contributor responsible for all 16 commits in the last three months, plus no repository security policy or security-scanning tooling and no changelog. These concerns warrant operational review but do not outweigh the strong release cadence, active repository, and project backing.
82%
Total Score
80
100
89
90
Only one account has registry publish access, which is a concentration risk, although the organization-backed repository and active release cadence provide compensating evidence.
One contributor made all 16 commits in the last three months, creating a meaningful single-maintainer continuity risk. Organization ownership provides some ability to hand off maintenance, but no second active contributor is shown.
The repository has only 2 stars, 0 forks, and 1 watcher. Low popularity is supporting evidence rather than a verdict, but it provides little external resilience or adoption evidence.
Composer is used as a build tool, but no security-scanning tools are configured. The absent scanning is a security-hygiene gap rather than evidence of abandonment.
The repository has no SECURITY.md or other detected security policy, leaving vulnerability-reporting and response expectations less transparent despite the README providing an email contact.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
pop-cms-schema/comments Version ^19.2.4 | — | — |
pop-cms-schema/customposts Version ^19.2.4 | — | — |
pop-cms-schema/user-state-mutations Version ^19.2.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.