steverhoades/oauth2-openid-connect-server
The repository includes tests and release notes, and the package has a clear MIT license with modest dependencies. A single maintainer, no security policy or scanning, and inactive development reduce confidence for a security-sensitive dependency.
61%
Total Score
50
100
88
67
Health Score Breakdown
Only one registry account can publish releases. The linked repository is also owned by that individual, so this is a real bus-factor limitation rather than ordinary organization publishing hygiene.
The repository and registry are owned by the same individual rather than an organization, so there is no observed organizational backing to offset the thin maintainer base.
The package has 17 releases over about 10 years, but no releases in the last 12 months; the latest release was in September 2024. This indicates established history but currently slow maintenance.
There were no commits and no active maintainers in the last three months, showing no recent development activity. The recent release history does not compensate for this current inactivity.
Composer build tooling is present, but no security scanning tools were detected. For an authentication-related package, that is a meaningful oversight gap.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Steve Rhoades |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 lcobucci/jwt Version 4.1.5|^4.2|^4.3|^5.0 | — | — |
league/oauth2-server Version ^8.4.2|^9.0 | — | — |
Weekly Downloads
Info
- Last Published
- 1 year ago
- Created
- 9 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.