itjackjw/simple-jwt

Release historydanger

This is the package's only release, published nearly three years ago, with no releases in the last 12 months. That leaves little evidence of ongoing maintenance.

Licensecaution

A license file is present, but it is identified as MIT while the manifest declares Apache-2.0. The release is licensed, yet the mismatch reduces transparency about the applicable terms.

Lifecycle scriptscaution

The package runs post-install and post-update scripts, increasing the code executed during dependency operations. No provided signal shows these scripts are necessary or narrowly scoped.

Maintainerscaution

The package has one registry maintainer, which is a thin publishing base for a user-owned project. This increases bus-factor concern, although it does not by itself show abandonment.

Repo commit activitycaution

The repository has had zero commits and zero active maintainers in the last three months, consistent with the long release gap. The repository is not archived, but current maintenance capacity is still unproven.