pop-cms-schema/users-wp

This is a mature, actively released, stable package with 162 releases since 2021, 33 releases in the last 12 months, a current non-archived repository, clear licensing, tests, and no install-time lifecycle scripts. The main concerns are that all 14 recent commits came from one contributor, the repository has no security scanning or security policy, and no changelog is included; the organization-owned repository and strong release cadence partly mitigate the maintainer concentration, but do not eliminate bus-factor risk. Overall, it appears reasonable to depend on, with ordinary due diligence around maintenance continuity and security practices.

Latest 19.2.4

Packagist

76%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account has publish access, which is a concentration concern, but the linked repository is owned by an organization and the package shows frequent recent releases.

Repo bus factor

One contributor made all 14 commits in the last 3 months, creating a genuine continuity and bus-factor concern. Organization ownership provides some handoff potential, but no second active contributor is shown.

Repo tooling

Composer build tooling is present, but no security scanning tools are reported. This is a security-process hygiene gap rather than evidence that the package is unsafe.

Security policy

The repository has no SECURITY.md or other detected security policy, leaving vulnerability-reporting and response procedures less transparent.