pohoc/sa-token
Frequent releases, a substantial README, tests, changelog, and security tooling support continued care. The workflows are fully audited and pinned, but reusable workflows inherit secrets; keep that exposure in mind for CI. The package is still early-stage.
67%
Total Score
67
100
94
83
Health Score Breakdown
The package and repository are owned by the same individual account, so there is no organizational backing shown to offset the concentrated maintainer base.
All 16 recent commits came from one contributor, leaving maintenance and release continuity dependent on a single person.
Version v0.2.2 is not a stable major release, so compatibility may still change despite the absence of prereleases in the recent history.
All three workflows were analyzed, use read-only permissions, and pin all 10 action references. However, two high-confidence medium-severity findings show reusable workflows inheriting secrets, which widens credential exposure.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 pohoc |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 pohoc/crypto-sm Version ^0.3 | — | — |
firebase/php-jwt Version ^7.0 | — | — |
psr/http-message Version ^2.0 | — | — |
psr/simple-cache Version ^3.0 | — | — |
Weekly Downloads
Info
- Last Published
- 25 days ago
- Created
- 5 months ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.