pop-schema/usermeta-wp

This is a mature, actively released, stable package with 162 releases since 2021, 33 releases in the last 12 months, a current non-prerelease version, a non-archived organization-owned repository, tests, clear licensing, and no install-time lifecycle scripts. The main concerns are that all 16 commits in the last three months came from one contributor, the repository has no security scanning or security policy, and neither the artifact nor repository provides a changelog despite the README referring to one. These issues warrant some supply-chain and continuity caution, but the strong release cadence, repository linkage, organization backing, and package transparency make the package generally reasonable to depend on.

Latest 19.2.4

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

The artifact has a substantial README and tests, but no changelog, while the README points consumers to a CHANGELOG that is not present; the strong release history partly offsets this documentation gap but does not eliminate it.

Repo bus factor

One contributor made all 16 commits in the last three months, and no second active contributor is shown; despite organization backing, this leaves a genuine continuity and bus-factor concern.

Repo issue activity

There were no new or closed issues or pull requests in the last month and no merged pull requests; this gives little evidence of community activity, though it is not a severe concern for a small component.

Repo popularity

The repository has zero stars and forks and one watcher; this is weak supporting evidence, but popularity is not decisive and is outweighed by the package's release and commit activity.

Repo tooling

Composer is used as a build tool, but no security scanning tools are configured; the absence of scanning lowers assurance even though it is not evidence of maliciousness.