pop-cms-schema/media-wp

This is a mature, actively released, stable package with 162 releases since 2021, 33 releases in the last 12 months, a recent release, a non-archived organization-owned repository, clear licensing, tests, and no install-time lifecycle scripts. The main concerns are that all 14 commits in the last 3 months came from one contributor, the repository has very little visible popularity, no security policy or security scanning, and no changelog was detected; these are meaningful transparency and continuity gaps but are partly offset by the organization backing and strong release cadence. Overall, it appears reasonable to depend on, with some maintainer-concentration and security-process risk.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

A substantial README and tests are present, and the README documents installation, usage, development, testing, and security reporting. No changelog was detected in either artifact or repository, which is a modest transparency gap.

Repo bus factor

All 14 recent commits came from one contributor, creating a low bus factor. The organization-owned repository partly compensates because maintenance can potentially be handed off within the organization, but no second active contributor is shown.

Repo issue activity

There were no new or closed issues or pull requests in the last month, and the open pull-request count is zero. This provides little evidence of community activity, though it is not inherently unhealthy for a small stable component.

Repo popularity

The repository has 1 star, 0 forks, and 1 watcher, indicating limited external adoption or visibility. Popularity is supporting evidence rather than a verdict, so this is a minor caution rather than a severe risk.

Repo tooling

Composer is used as a build tool, but no security scanning tools are detected. The build tooling is appropriate, while the missing security automation is a process gap.