medzuch/jwt-bundle
This release presents a strong dependency-health profile: it is not deprecated or archived, has substantial documentation and tests, a license file, reproducible-looking repository scaffolding, active recent development, security policy and tooling, and read-only workflow permissions. The main concerns are that the package is only 15 days old, has no adoption signals yet (0 stars and 0 forks), and recent commits are concentrated in one primary contributor (89.7%), although a second contributor is active and the repository shows significant issue and pull-request throughput. It appears reasonable to adopt with normal review of a young dependency and its release process, but it has not yet demonstrated long-term stability or a broad maintainer base.
82%
Total Score
70
100
89
100
Health Score Breakdown
Only one registry account has publish access. Because the repository is user-owned rather than organization-owned, this indicates some publishing concentration, though repository activity provides compensating evidence of active maintenance.
The repository is owned by the individual user medzuch rather than an organization, so there is no organizational succession signal; this is partly offset by the observed second contributor and active project work.
The package is very young at 15 days, which limits evidence of long-term maintenance, but it has already produced 7 releases with a median interval of about 1.5 days, showing active iteration rather than abandonment.
Two contributors are active, but the leading contributor made 52 of 58 recent commits (89.7%), creating meaningful maintainer-concentration risk. The second contributor's activity partly compensates for the concentration but does not eliminate it.
The repository has 0 stars, forks, and watchers. This is weak external adoption evidence, but popularity is supporting evidence and the package's very young age explains why it may not yet have accumulated users.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Marcin Mech |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 psr/clock Version ^1.0 | — | — |
symfony/yaml Version ^6.4 || ^7.4 || ^8.0 | — | — |
symfony/config Version ^6.4 || ^7.4 || ^8.0 | — | — |
medzuch/jwt-php Version ^1.2.1 | — | — |
symfony/http-kernel Version ^6.4 || ^7.4 || ^8.0 | — | — |
Weekly Downloads
Info
- Last Published
- 1 month ago
- Created
- 1 month ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.