pop-schema/usermeta

This is a healthy, actively maintained release with a five-year history, 162 releases, 33 releases in the last 12 months, a stable non-prerelease version, an active non-archived repository, and clear licensing. The package has a small runtime dependency set, tests in both the artifact and repository, and no install-time lifecycle scripts or identified dangerous workflows. The main concerns are that all 15 recent commits came from one contributor, repository popularity is very low, and there is no repository security policy or security-scanning tooling; however, organization ownership, frequent releases, recent repository activity, and package/repository alignment substantially reduce abandonment and transparency concerns.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account has publish access, creating publishing concentration; this is partly compensated by the linked repository being owned by an organization and by strong recent release activity.

Repo bus factor

One contributor made all 15 commits in the last 3 months, creating a genuine bus-factor concern; organization ownership provides some ability to transfer maintenance, but no second active contributor is evidenced.

Repo popularity

The repository has only 1 star, 0 forks, and 1 watcher, indicating limited external adoption or visibility; this is supporting evidence rather than a decisive health problem for a small package.

Repo tooling

Composer build tooling is present, but no security-scanning tools are reported, leaving a security-process gap despite the package's otherwise clear build setup.

Security policy

The repository has no SECURITY.md or other detected security policy, reducing transparency about vulnerability reporting and response.