Package Health/web-token/encryption-pack

web-token/encryption-pack

The MIT declaration, stable versioning, and absence of install-time scripts reduce avoidable risk. The organization-backed repository remains unarchived, but it has had no commits in the last three months, lacks security scanning, and does not identify this package in its README.

Latest 3.4.8

Packagist

18%

Total Score

Maintainer Stability

Maturity

Supply Chain

Using this package? Scan for Free

Health Score Breakdown

Registry deprecation

Packagist marks the entire package as abandoned and explicitly recommends web-token/jwt-library instead. This is a severe adoption risk even though the release itself is not separately withdrawn.

Release history

The package has 73 releases since June 2019, but its latest release was in February 2024 and there were no releases in the last 12 months. That long release gap supports the abandonment concern.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months. Although the repository was pushed more recently, the current activity snapshot indicates limited ongoing maintenance.

Repo package mention

The repository name matches the package, but its README does not mention the package name. That weakens package-to-source traceability, though the matching repository name provides some compensation.

Repo tooling

Composer is used as the build tool, but no security scanning tools were detected. The missing security automation is a maintenance and transparency gap.