This release appears healthy and suitable to depend on: it has a clear GPL-2.0-or-later license, a substantial and coherent 91-file package with tests, active recent publishing, and 33 releases in the last 12 months. The linked repository is active, non-archived, correctly associated with the package, and organization-backed. The main concerns are that all 15 commits in the last 3 months came from one contributor, the repository has no security scanning or security policy, and no changelog was detected; these reduce resilience and transparency but are outweighed by the strong release cadence and current maintenance evidence.
82%
Total Score
80
50
89
100
Five runtime dependencies and four development dependencies indicate a nontrivial dependency surface that warrants routine review, but the profile is not extreme for this modular PHP component.
All 15 recent commits came from one contributor, creating a concentrated maintenance dependency; organization backing partly mitigates handoff risk, but no second active contributor is evidenced.
There are no open issues or pull requests, but there was also no issue or pull-request activity in the last month. This gives limited evidence about community responsiveness rather than clear evidence of abandonment.
The repository has only 1 star and 0 forks, providing little external validation; this is supporting evidence only and does not outweigh the strong release and activity signals for a specialized package.
Composer is used as a build tool, but no security scanning tools are detected. The missing scanning is a hygiene gap, though it is not by itself evidence that the package is unsafe or abandoned.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
pop-cms-schema/post-tags Version ^19.2.4 | — | — |
pop-cms-schema/tag-mutations Version ^19.2.4 | — | — |
pop-cms-schema/post-mutations Version ^19.2.4 | — | — |
pop-cms-schema/custompost-tag-mutations Version ^19.2.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.