This is a healthy, mature release with a five-year history, 162 releases, 33 releases in the last 12 months, and a short median release interval of about 4 days. It is a stable major release, not deprecated, licensed under GPL-2.0-or-later, includes a README and license, has repository tests and Composer build tooling, and was pushed very recently. The main concerns are that all 15 recent commits came from one contributor, the repository has no security scanning or security policy, and repository popularity is minimal; however, the organization-owned repository and sustained release activity provide meaningful backing and reduce abandonment risk. It appears reasonable to depend on, subject to normal review of its runtime dependencies and security-sensitive user-authentication behavior.
82%
Total Score
80
100
89
90
Recent activity is fully concentrated in one contributor, creating a genuine bus-factor concern; organization ownership and continued recent commits partially compensate but do not remove the concentration risk.
There were no new or merged pull requests in the last month and issue counts are partly unknown, so issue-management evidence is limited; this is tempered by the package's active release history.
The repository has zero stars and forks and one watcher, indicating little public adoption evidence; popularity is supporting evidence only, and the strong release and commit history is more informative here.
Composer build tooling is present, but no security-scanning tools are detected; the missing scanning is a hygiene gap rather than evidence of abandonment.
The repository has no SECURITY.md policy, reducing transparency around vulnerability reporting; the README does provide a security contact, which partially compensates.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
pop-cms-schema/user-state Version ^19.2.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.