This is a healthy, actively maintained release with a strong six-year history, 161 releases, 33 releases in the last 12 months, and a latest release published very recently. The package is stable, not deprecated, linked to a matching organization-owned repository that contains tests and substantial source scaffolding, and it has no install-time lifecycle scripts. The main concerns are that all 16 commits in the last three months came from one contributor, the repository has no security scanning or security policy, and the package has no changelog; these are meaningful transparency and continuity gaps but are partly offset by the organization backing, frequent releases, current repository activity, and explicit README guidance. It appears reasonable to depend on, with normal diligence around maintainer continuity and security practices.
88%
Total Score
80
100
89
100
One contributor made all 16 recent commits, creating a genuine bus-factor and continuity concern. The organization-owned repository provides some capacity to hand off maintenance, so this is caution rather than a severe abandonment signal.
There were no new or merged pull requests in the last month and no issue activity was recorded, which limits evidence of community engagement. This is tempered by the absence of open pull requests and the package's frequent release history.
The repository has zero stars and forks and only one watcher, indicating limited visible adoption. Popularity is supporting evidence rather than a verdict, and the package's release and commit activity provide stronger health evidence.
Composer build tooling is present, but no security-scanning tools were detected. The build setup is appropriate, while the missing security automation is a hygiene gap.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
pop-cms-schema/user-roles Version ^19.2.4 | — | — |
pop-cms-schema/customposts Version ^19.2.4 | — | — |
pop-schema/extended-schema-commons Version ^19.2.4 | — | — |
pop-cms-schema/user-state-mutations Version ^19.2.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.