simplesamlphp/simplesamlphp-module-oidc

Name lookalikedanger

The package borrows the identity of simplesamlphp/saml2, which has 289,094 monthly downloads versus 947 here; borrows_lookalike_identity is true even though artifact overlap is only 0.02. Consumers may have intended the established package instead, making this a severe adoption risk.

Dependency profilecaution

The package declares 21 runtime dependencies, including several framework and protocol components. This is a substantial dependency surface, but it is consistent with a full OIDC server module rather than an unexplained bundle.

Repo bus factorcaution

Two contributors were active, but one made 5 of 6 recent commits, an 83% share. Organizational backing partly offsets this concentration, but it remains a maintenance weakness.

Security policycaution

The repository has no security policy. That is a transparency gap for an OIDC security module, although active scanning and current commits provide partial compensation.

Workflow auditcaution

All 3 workflows were analyzed successfully with no untrusted checkouts, script injection, or audit findings. However, all 24 action references are unpinned, leaving workflow dependencies exposed to upstream changes.