nikolasok/jwt-auth

Release historydanger

The package has had no release in about five years and none in the last 12 months, despite 49 historical releases. This is strong evidence of abandonment for a library that integrates with changing framework and authentication ecosystems.

Repo commit activitydanger

There were zero commits and zero active maintainers in the last three months, consistent with the package's long release gap. This leaves little evidence that defects or compatibility issues are being addressed.

Security policycaution

The repository has no security policy. For an authentication library, that is a meaningful transparency gap because it gives users no documented reporting path, although it does not by itself show a security defect.

Version stabilitycaution

The assessed release is a release candidate while the registry's latest version is stable 1.0.3, making this specific version less suitable for new adoption. The stable major version provides some compensating maturity evidence.

Workflow auditcaution

The workflow audit completed fully and found no untrusted checkout or script-injection path. All four action references are unpinned, and the low-confidence cache-poisoning finding is hygiene rather than a decisive risk.