simplesamlphp/simplesamlphp-module-fticks

Name lookalikedanger

The package borrows the identity of the much more established simplesamlphp/saml2, with 330 monthly downloads versus 264,983 and borrows_lookalike_identity=true. Although artifact overlap is 0 and the README does not identify it as a copy, the identity signal still creates a serious risk that consumers intended to select the lookalike package.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months. This is partly offset by three registry releases in the last 12 months, but the current source activity still weakens confidence in ongoing maintenance.

Security policycaution

The linked repository has no security policy. This reduces transparency for reporting and handling vulnerabilities, although Dependabot and composer-audit provide some compensating security tooling.

Workflow auditcaution

All 24 analyzed action references are unpinned, creating avoidable build reproducibility and dependency-change risk. The audit found no untrusted checkout or script injection, but one workflow has top-level write permissions, which adds a smaller hygiene concern.