zhuchunshu/php-csrf

Release historydanger

The package has only three releases, all published in July 2021, with no release in roughly five years. This is the strongest evidence of possible abandonment for a dependency.

Repo commit activitydanger

There were no commits and no active maintainers in the three months before collection. Combined with the absence of recent registry releases, this indicates weak current maintenance.

Maintainerscaution

Only one registry maintainer is listed, so publishing continuity depends on a single individual. The matching user-owned repository provides some backing but does not remove the bus-factor concern.

Project backingcaution

The package and repository are owned by the same individual account rather than an organization. This is consistent and transparent, but it offers limited visible institutional backing.

Repo toolingcaution

Composer is used for builds, but no security-scanning tooling is present. For a security-focused CSRF package, that is a meaningful hygiene gap, though not evidence of unsafe code by itself.