This is a healthy, actively maintained Composer package with a long release history, 154 releases since 2021, 33 releases in the last 12 months, a stable non-prerelease version, and a repository that is not archived and was pushed at the time of assessment. The package is licensed, includes tests and substantial source content, has no install-time lifecycle scripts, and its repository matches and documents the package. The main concerns are that recent commit activity is concentrated in one contributor, the repository has no security scanning or security policy, and the repository has very little public popularity; however, organization ownership, frequent releases, and direct package/repository alignment substantially reduce abandonment and transparency concerns.
82%
Total Score
70
100
89
90
Only one registry account has publish access, which is a modest publishing-continuity concern. The repository's organization ownership and frequent observed releases provide compensating evidence that this is not by itself a severe risk.
All 15 recent commits came from one contributor, creating contributor-concentration risk. Organization ownership provides some ability to hand maintenance off, so this is a caution rather than a severe health failure.
The repository recorded 15 commits in the last three months, demonstrating current activity, but all were made by one active maintainer.
The repository has zero stars and forks and one watcher, indicating limited public adoption or visibility. Popularity is supporting evidence rather than a verdict, so this is only a minor concern given the strong release activity.
Composer is used as a build tool, but no security-scanning tools are detected, leaving a security-process gap that modestly reduces transparency and assurance.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
pop-cms-schema/tags Version ^19.2.4 | — | — |
pop-cms-schema/taxonomy-mutations Version ^19.2.4 | — | — |
pop-cms-schema/custompost-mutations Version ^19.2.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.