neamil/device_cookies

a base for a php implementation of device cookies as described in OWASP https://www.owasp.org/index.php/Slow_Down_Online_Guessing_Attacks_with_Device_Cookies

Latest 1.0.1

Packagist

18%

Total Score

critical

Unfit to use: the package is deprecated and has had no release or commit activity for about six years.

Using this package? Scan for Free

Health Score Breakdown

Registry deprecation

Packagist marks the entire package as abandoned, with no replacement specified. This is a severe adoption risk because the package is explicitly withdrawn from active support.

Release history

Only two releases exist, and the latest was published on July 18, 2020; there have been no releases in the last 12 months. The long period without releases indicates substantial abandonment risk.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, while its last push was in July 2020. This confirms that the release gap reflects stalled project activity rather than merely a stable release cadence.

Workflow audit

Both workflows use all six analyzed actions without pinning, and the audit found high-confidence template-injection and unpinned-image findings. No untrusted checkout or dangerous trigger was reported, so this is a meaningful hygiene concern rather than the primary adoption blocker.