This is a healthy, actively maintained release with a strong release cadence: it has existed for over five years, received 33 releases in the last 12 months, and was updated very recently. The package is licensed, has a substantial source tree, README, tests, stable-version status, no deprecation notice, no install-time scripts, and a correctly matching repository with organization backing. The main concerns are that all 15 recent commits came from one contributor, the repository has no security-scanning tooling or security policy, and no changelog was detected; these reduce resilience and transparency but do not outweigh the evidence of ongoing maintenance and frequent releases.
82%
Total Score
70
100
89
90
One contributor made all 15 commits in the last three months, creating a genuine single-person continuity risk. Organization ownership provides some potential handoff capacity, but no second active contributor is shown.
The repository recorded 15 commits in the last three months, showing active development, but all activity came from one maintainer.
There are no open issues or pull requests and no issue or pull-request activity in the last month. This is not inherently negative for a small stable package, but it offers limited evidence of community engagement.
The repository has only 1 star, 0 forks, and 1 watcher. Low popularity is supporting evidence rather than a verdict, but it provides little external adoption signal.
Composer is used as a build tool, but no security-scanning tools are configured. This is a security-hygiene gap, although it does not by itself indicate abandonment or maliciousness.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
pop-cms-schema/categories Version ^19.2.4 | — | — |
pop-cms-schema/taxonomy-mutations Version ^19.2.4 | — | — |
pop-cms-schema/custompost-mutations Version ^19.2.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.