This is a healthy, actively maintained release with a mature history: it has existed since 2021, has 162 releases, 33 releases in the last 12 months, and publishes stable versions frequently. The package is licensed, linked to a matching organization-owned repository, includes tests and a clear README, has no install-time lifecycle scripts, is not deprecated or archived, and shows recent commit activity. The main concerns are that all 15 recent commits came from one contributor, the repository has no security policy or security-scanning tooling, and repository popularity is modest; these are meaningful transparency and continuity gaps but are partly mitigated by the organization backing and strong release cadence.
82%
Total Score
70
100
89
90
Only one registry account has publishing access, which is a continuity concern, though this is partly mitigated by the linked repository being owned by an organization and by its active release cadence.
One contributor made all 15 commits in the last 3 months, creating a meaningful concentration and continuity risk; organization ownership provides some mitigation because maintenance can potentially be handed off.
There were no new or closed issues or pull requests in the last month and no open pull requests. This offers little evidence of community activity, but the null open-issue count makes the overall signal limited rather than strongly negative.
The repository has only 3 stars, 0 forks, and 1 watcher, indicating limited public adoption evidence; this is supporting caution rather than a decisive health problem for a small specialized package.
Composer is used as a build tool, but no security-scanning tools are present. The build tooling is appropriate, while the missing security automation is a transparency gap.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
pop-cms-schema/users-wp Version ^19.2.4 | — | — |
pop-cms-schema/user-roles Version ^19.2.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.