gdshenrun/simple-jwt
The license metadata conflicts with the MIT license file, and install-time scripts increase deployment exposure. Tests, a matching repository, and a usable README provide some transparency, but there is no recent maintenance or security policy.
35%
Total Score
50
60
67
Health Score Breakdown
This is the package's only release, published about 5 years and 8 months ago, with no releases in the last 12 months. That strongly raises abandonment risk for a security-sensitive JWT library.
The repository recorded zero commits and zero active maintainers in the last 3 months, consistent with the long release gap. No provided activity signal compensates for this lack of maintenance.
The manifest declares Apache-2.0, while the artifact and repository license file are detected as MIT. The release is licensed, but the mismatch creates a real transparency and compliance concern.
The package runs post-install and post-update Composer scripts, adding execution during dependency installation and updates. This is a supply-chain hygiene concern even though it does not establish malicious behavior.
The project uses Composer build tooling, but no security scanning tools were detected. For an old JWT library, the missing scanning coverage is a modest maintenance and transparency gap.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 appledady |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 doctrine/cache Version ^1.10 | — | — |
Weekly Downloads
Info
- Last Published
- 5 years ago
- Created
- 5 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.