This is a mature, actively released, stable package with 161 releases since January 2021, 32 releases in the last 12 months, a current unarchived repository, matching package source, tests, a clear license, and no install-time lifecycle scripts. The main concerns are that all 15 recent commits come from one contributor, the repository has no security scanning or security policy, and repository popularity is minimal; however, the organization-owned project backing, strong release cadence, and direct repository/package alignment substantially reduce abandonment and transparency risk. It appears reasonable to depend on, with normal operational safeguards and awareness of the single-contributor bus factor.
78%
Total Score
80
100
89
90
One contributor made all 15 commits in the last 3 months, producing a complete concentration of recent work. Organization ownership provides some handoff potential, but no second active contributor is shown, so maintainer continuity remains a real risk.
There were no new or closed issues or pull requests in the last month, and open issue count is unknown. This provides little evidence of community support, but it is not a severe concern for a small component with ongoing release activity.
The repository has zero stars and forks and only one watcher, so there is little external adoption evidence. Popularity is supporting evidence rather than a health verdict, and the package's strong release history compensates for this weakness.
Composer build tooling is present, but no security scanning tools are configured. Build reproducibility is supported, while security-process transparency is weaker.
The repository has no SECURITY.md or other detected security policy, leaving vulnerability reporting and response expectations less explicit. The README does provide a security email, which partially compensates for the missing repository policy.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
pop-cms-schema/comments Version ^19.2.4 | — | — |
pop-cms-schema/comments-wp Version ^19.2.4 | — | — |
pop-cms-schema/customposts-wp Version ^19.2.4 | — | — |
pop-cms-schema/comment-mutations Version ^19.2.4 | — | — |
pop-cms-schema/user-state-mutations-wp Version ^19.2.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.