simplesamlphp/simplesamlphp-module-webauthn

Name lookalikedanger

The package is flagged as borrowing the identity of the much more established simplesamlphp/saml2 package, with 256,649 monthly downloads versus 31 and borrows_lookalike_identity set to true. Although artifact overlap is zero and the README does not identify it as the lookalike, this remains a severe adoption risk.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. That is a meaningful maintenance warning despite the package having released four times in the last 12 months.

Security policycaution

The linked repository has no security policy. This reduces vulnerability-reporting transparency for an authentication module, although Dependabot and composer-audit provide some compensating security tooling.

Workflow auditcaution

All 24 analyzed action references are unpinned, and one workflow grants top-level write permissions; no untrusted trigger or audit finding was reported. The repository is not exposed to the most serious workflow risks, but its build inputs are harder to control.