simplesamlphp/simplesamlphp-module-autotest

Name lookalikedanger

The package is marked as borrowing the identity of simplesamlphp/assert, which has far more downloads and stable releases. Although artifact overlap is 0 and the README does not identify it as a lookalike, this remains a serious risk that consumers may have intended to install the established package.

Release historycaution

The package has only 6 releases across roughly 10.5 years, with a median interval of about 2.1 years and only 1 release in the last 12 months. The recent release reduces abandonment concern somewhat, but the long-term cadence is sparse.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months. A recent package release and push provide some compensating evidence, but current development activity remains thin.

Security policycaution

The repository has no security policy. This is a transparency gap, though organization backing and automated dependency scanning partly reduce its significance.

Workflow auditcaution

All 24 analyzed action references are unpinned, and the audit found two high-confidence medium-severity secrets-inherit findings in php.yml. One workflow also grants top-level write permissions, while no untrusted checkout or script-injection paths were found.