dksdev01/simplesamlphp

Release historydanger

The package shows 127 releases but all were published on the same day, with no releases in the last 12 months. That pattern is inconsistent with an actively maintained release stream and lowers confidence in the assessed release.

Repo commit activitydanger

No commits or active maintainers were recorded in the last three months. That is strong evidence of stalled maintenance, especially alongside the lack of recent registry releases.

Workflow auditdanger

All 33 analyzed action references are unpinned, and the audit found a high-confidence template-injection issue in the release workflow. The absence of untrusted checkout and script-injection findings is reassuring, but the release automation still has meaningful hygiene and integrity risk.

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts. These may be legitimate for a PHP application, but they increase installation-time behavior and deserve more trust than a package without lifecycle execution.

Repo popularitycaution

The repository has zero stars, forks, and watchers. Popularity is not required for health, but this provides no supporting evidence of an established or independently used project.