This is a healthy, mature release with a five-year history, 163 releases, 33 releases in the last 12 months, a stable non-prerelease version, active recent publishing, and an unarchived repository that matches the package and documents it. The package includes a license, README, tests, Composer build metadata, and no install-time lifecycle scripts. The main concerns are that all 15 commits in the last three months came from one contributor, the repository has no security-scanning tooling or security policy, and no changelog is present despite being referenced in the README; organizational ownership and strong release activity partially mitigate the maintainer-concentration concern.
82%
Total Score
70
100
83
90
Only one registry account has publish access, but this is partly mitigated by the linked repository being owned by an organization and by strong observed release activity; it remains a modest publishing-continuity concern.
A substantive README and tests are present in both the artifact and repository, although no changelog was detected despite the README referring to one, leaving a minor documentation gap.
One contributor made all 15 commits in the last three months, creating a genuine continuity risk. Organizational repository ownership provides some handoff potential, but no second active contributor is shown.
There were no new or closed issues or pull requests in the last month and no merged pull requests; this provides little evidence of community interaction, though it is not by itself evidence of abandonment.
The repository has one star, zero forks, and one watcher. This indicates limited adoption evidence, but popularity is supporting evidence and does not outweigh the package's substantial release and maintenance history.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
pop-schema/extended-schema-commons Version ^19.2.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.