simplesamlphp/simplesamlphp-module-aggregator2

Name lookalikedanger

The package is flagged as borrowing the identity of simplesamlphp/assert, which has far more downloads and stable releases; this creates a substantial risk that consumers wanted the established package instead.

Release historycaution

The package has existed for about 10 years but has only 8 releases, with one release in the last 12 months and a median interval of about 323 days; this points to a slow maintenance cadence.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months, indicating currently inactive development despite the repository not being archived.

Security policycaution

The linked repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.

Workflow auditcaution

All 24 analyzed action references are unpinned, one workflow grants top-level write access, and high-confidence secrets-inherit findings affect php.yml. No untrusted checkout or script-injection path was found, limiting the severity.