This is a healthy, actively maintained Composer package with a long history, 154 releases, 33 releases in the last 12 months, recent publication, stable versions, a non-deprecated registry status, an identifiable and matching source repository, tests, licensing, and no install-time lifecycle scripts. The main concerns are that all 15 commits in the last 3 months came from one contributor, the repository has no security scanning or security policy, and the project has little visible external popularity or issue activity; however, the organization-owned repository and strong release cadence materially reduce abandonment risk. It appears reasonable to depend on, with normal supply-chain and maintainer-continuity precautions.
82%
Total Score
80
100
89
90
One contributor made all 15 recent commits, creating a genuine maintainer-continuity risk; the organization-owned repository partially compensates because maintenance can potentially be handed off within the project.
There are no open issues or pull requests and no issue or PR activity in the last month. This provides little evidence of community engagement, though it is not inherently negative for a small stable package.
The repository has zero stars and forks and one watcher, indicating limited external visibility; this is supporting caution rather than a decisive health problem for a small component package.
Composer is used as a build tool, but no security scanning tools are detected. The build tooling is appropriate, while the absent scanning is a modest transparency and assurance gap.
The repository has no SECURITY.md or other detected security policy, leaving vulnerability-reporting and response expectations less transparent.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
pop-cms-schema/tags Version ^19.2.4 | — | — |
pop-cms-schema/taxonomy-mutations Version ^19.2.4 | — | — |
pop-cms-schema/custompost-mutations Version ^19.2.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.