wikimedia/common-passwords

Name lookalikedanger

The package is flagged as borrowing the identity of wikimedia/css-sanitizer, with borrows_lookalike_identity true, even though artifact overlap is 0.0 and the README does not identify it as a fork. This is a serious supply-chain transparency concern because consumers may have intended the lookalike package.

Release historycaution

The package has 10 releases over about 9 years, but none in the last 12 months; its latest release was over a year before collection. This indicates a slow or paused release cadence for a package developers may depend on for an evolving password list.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months. Although the repository was pushed recently and contains tests, there is little evidence of current development activity.

Repo package mentioncaution

The linked repository name does not match wikimedia/common-passwords and its README does not mention the package, so the package-to-source relationship is not clearly established. The matching Wikimedia organization provides some context but does not remove this transparency gap.

Repo toolingcaution

The repository uses Composer for builds, but no security scanning tools were detected. The build setup is present, while the missing scanning is a modest transparency gap rather than a standalone severe risk.