deadlymous/jwt

The package includes tests, a changelog, and no install-time scripts. Its sole registry maintainer, absent security policy, and conflicting license evidence provide little transparency around an otherwise inactive project.

Latest 1.0.3

Packagist

28%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

The latest release was about 5 years ago, with no releases in the last 12 months and only three releases overall. This is strong evidence of abandonment for a dependency that may need ongoing compatibility fixes.

Repo commit activity

The repository recorded zero commits and zero active maintainers during the last 3 months, consistent with the package having been inactive since April 2021. No provided maintenance signal compensates for this gap.

License

The artifact declares MIT, but the detected license text is Apache-2.0 despite license files being present. The mismatch creates a real licensing uncertainty even though the release is not unlicensed.

Repo package mention

The linked repository name does not match the package name, and its README does not mention the package. That weakens confidence that the repository is the package's genuine project home.

Security policy

The repository has no security policy. For an authentication and JWT package, this is a meaningful transparency gap because consumers have no documented vulnerability-reporting process.