This is a mature and actively maintained release with a five-year history, 162 releases, 33 releases in the last 12 months, a recent publication, stable versioning, an unarchived repository, clear licensing, tests in the artifact and repository, and no install-time lifecycle scripts. The main concerns are that all 15 recent commits came from one contributor, the repository has minimal popularity, and no security scanning or security policy was observed; these reduce resilience and transparency but do not outweigh the strong release and maintenance evidence, particularly given the organization-owned repository.
82%
Total Score
70
100
89
80
The 15-file tree is coherent for a focused Composer library, containing source code, configuration, documentation, licensing, and tests. The single disabled test file limits evidence of effective test coverage, but the repository-level test presence is still positive.
One contributor made 100% of the 15 recent commits, creating a clear single-maintainer continuity risk. The organization-owned repository provides some potential handoff capacity, which makes this a caution rather than a danger.
The repository recorded 15 commits in the last 3 months, all from one active maintainer, demonstrating current maintenance but limited contributor breadth.
There were no new or closed issues or pull requests in the last month, and no pull requests were open. This provides little evidence of an active external review community, though the absence of issue activity is less concerning for a small focused component with recent commits.
The repository has only 1 star, 0 forks, and 1 watcher, indicating limited external adoption or review. Popularity is supporting evidence rather than a verdict, so this is a modest caution rather than a severe risk.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
pop-cms-schema/meta Version ^19.2.4 | — | — |
pop-cms-schema/comments Version ^19.2.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.