kreait/firebase-tokens
Healthy and suitable to depend on. It has a long release history, a recent stable release, active repository maintenance, and repository tests despite none being packaged. The small active contributor base and missing security policy are the main caveats.
86%
Total Score
80
100
100
80
Health Score Breakdown
Only one registry account has publish access, which is a concentration risk, but the repository is owned by an organization and shows two active contributors, providing some operational backing.
Commit activity is highly concentrated in one contributor, with 13 of 14 commits, although a second contributor remains active and organization ownership provides some handoff capacity.
The repository has no security policy, leaving vulnerability reporting and response guidance less transparent than ideal for a library handling authentication tokens.
Neither workflow declares top-level token permissions. No workflow requests top-level write access, but explicit least-privilege declarations would provide stronger CI security hygiene.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Jérôme Gamez |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 psr/cache Version ^1.0|^2.0|^3.0 | — | — |
beste/clock Version ^3.0 || ^4.0 | — | — |
lcobucci/jwt Version ^5.2 | — | — |
guzzlehttp/guzzle Version ^7.8.2 || ^8.0 | — | — |
fig/http-message-util Version ^1.1.5 | — | — |
Weekly Downloads
Info
- Last Published
- 8 days ago
- Created
- 9 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.