hokaccha/node-jwt-simple: Risky

Decision in one minute

hokaccha/node-jwt-simple is assessed as Risky due to lack of active maintenance and weak security posture. It has seen no release and no default-branch commit in the last 365 days, with the last commit occurring 2,014 days ago. Additionally, its OpenSSF Scorecard score is 2.8 out of 10 and it lacks a security policy.

Strengths

None of the 2 known vulnerabilities for jwt-simple (npm) affect the latest version (0.5.6).
Source: None of the 2 known vulnerabilities for jwt-simple (npm) affect the latest version (0.5.6).
Licensed under MIT (OSI-approved).
Source: Licensed under MIT (OSI-approved).
156,446 downloads last week on npm.
Source: 156,446 downloads last week on npm.

Concerns

No release and no default-branch commit in the last 365 days.
Source: No release and no default-branch commit in the last 365 days.
OpenSSF Scorecard score is 2.8 out of 10.
Source: OpenSSF Scorecard score is 2.8 out of 10.
Last commit to the default branch was 2,014 days ago.
Source: Last commit to the default branch was 2,014 days ago.

Verify before adopting

Verify whether the lack of updates since the last tag 2,759 days ago (v0.5.6) introduces compatibility or security gaps for your runtime.Source: Last tag was 2,759 days ago (v0.5.6).
Inspect the repository for unpatched vulnerabilities given that the OpenSSF Scorecard score is 2.8 out of 10.Source: OpenSSF Scorecard score is 2.8 out of 10.
Determine an internal escalation path or fork strategy given that 0 people committed in the last 365 days.Source: 0 people committed in the last 365 days.
Establish vulnerability reporting and response procedures since no security policy (SECURITY.md) was found.Source: No security policy (SECURITY.md) was found.

Uncertainty: Issue responsiveness was evaluated with a sample size of only 1 issue, PR responsiveness had 0 sampled, and CI status is unknown.

Written by Gemini Flash from the metrics and reasons below; every number was checked against the data, and the verdict and score come from fixed rules, not the model.

Explained

Why this verdict

7 concerns5 neutral3 positive

Score 41 from 85% of the weight; 1 hard gate applied.

ConcernHard gate: No release and no default-branch commit in the last 365 days.
ConcernOpenSSF Scorecard score is 2.8 out of 10.
ConcernLast commit to the default branch was 2,014 days ago.
ConcernLast tag was 2,759 days ago (v0.5.6).
ConcernNo tags in the last 365 days.
Concern0 people committed in the last 365 days.
ConcernNo security policy (SECURITY.md) was found.
NeutralNo GitHub security advisories published in the last 365 days.
Neutral0 commits in the last 365 days.
NeutralThe project publishes tags but not GitHub Releases, so there are no release notes to read.
NeutralGitHub community profile is 42 percent complete (informational).
Neutral1,356 GitHub stars (a weak signal on its own).
PositiveNone of the 2 known vulnerabilities for jwt-simple (npm) affect the latest version (0.5.6).
PositiveLicensed under MIT (OSI-approved).
Positive156,446 downloads last week on npm.

Breakdown

Nine dimensions

Security posture
Weight 20
28Risky
Source values
OpenSSF Scorecard
2.8 / 10OpenSSF Scorecard API · 19 Oct 2026, 05:16 UTC
Scorecard date
2026-10-12OpenSSF Scorecard API · 19 Oct 2026, 05:16 UTC
Advisories (365 days)
0GET /repos/{o}/{r}/security-advisories · 19 Oct 2026, 05:16 UTC
Known vulnerabilities
Weight 15
100Healthy
Source values
Package
npm: jwt-simpleEntered in admin
Latest version
0.5.6registry.npmjs.org · 19 Oct 2026, 05:16 UTC
Known vulnerabilities (all versions)
2OSV.dev POST /v1/query · 19 Oct 2026, 05:16 UTC
With a fixed version
2OSV.dev POST /v1/query · 19 Oct 2026, 05:16 UTC
Affecting the latest version
0queried with 0.5.6OSV.dev POST /v1/query · 19 Oct 2026, 05:16 UTC
Published in last 365 days
0OSV.dev POST /v1/query · 19 Oct 2026, 05:16 UTC
Most recent published
2019-06-06OSV.dev POST /v1/query · 19 Oct 2026, 05:16 UTC
Maintenance
Weight 15
5Risky
Source values
Archived
NoGET /repos/{owner}/{repo} · 19 Oct 2026, 05:16 UTC
Disabled
NoGET /repos/{owner}/{repo} · 19 Oct 2026, 05:16 UTC
Days since last default-branch commit
2,014 daysGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:16 UTC
Commits in last 365 days
0GET /repos/{o}/{r}/commits · 19 Oct 2026, 05:16 UTC
Release cadence
Weight 10
10Risky
from tags (no GitHub Releases)
Source values
Days since last release
2,759 daysBased on the 10 highest-version tags (no GitHub Releases)GET /repos/{o}/{r}/tags + commit dates · 19 Oct 2026, 05:16 UTC
Releases in last 365 days
0Based on the 10 highest-version tags (no GitHub Releases)GET /repos/{o}/{r}/tags + commit dates · 19 Oct 2026, 05:16 UTC
Median days between releases (2 years)
Not availableFewer than 3 releases in the last 2 yearsGET /repos/{o}/{r}/tags + commit dates · 19 Oct 2026, 05:16 UTC
Uses GitHub Releases
No, tags onlyGET /repos/{o}/{r}/tags + commit dates · 19 Oct 2026, 05:16 UTC
Latest release
v0.5.6GET /repos/{o}/{r}/tags + commit dates · 19 Oct 2026, 05:16 UTC
Responsiveness
Weight 10
—No data
Insufficient data: Only 1 recent issues or PRs to sample
Source values
Issues sampled
1issues updated in the last 90 days, PRs excluded, bots excludedGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:16 UTC
Pull requests sampled
0pull requests updated in the last 90 days, bots excludedGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:16 UTC
Median time to first response
Not availableNo sampled item had a response from someone other than its authorGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:16 UTC
Share with a maintainer response
0%sampledGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:16 UTC
Maintainer depth
Weight 10
20Risky
Partial data: contributor count only
Source values
Distinct contributors (365 days)
0GET /repos/{o}/{r}/commits · 19 Oct 2026, 05:16 UTC
Top contributor's share of commits
Not availableNo commits in the last 365 daysGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:16 UTC
Top contributor
Not availableunavailableGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:16 UTC
Low bus factor
Not availableunavailableGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:16 UTC
Governance and licensing
Weight 10
60Watch
Source values
License (SPDX)
MITGET /repos/{owner}/{repo} · 19 Oct 2026, 05:16 UTC
License status
OSI-approvedGET /repos/{owner}/{repo} + OSI list · 19 Oct 2026, 05:16 UTC
Security policy
NoGET /repos/{o}/{r}/contents/SECURITY.md (+ .github/, docs/) · 19 Oct 2026, 05:16 UTC
Code of conduct (info)
NoGET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:16 UTC
Contributing guide (info)
NoGET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:16 UTC
Issue templates (info)
NoGET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:16 UTC
Community profile (info)
42%GET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:16 UTC
CI health
Weight 5
—No data
Insufficient data: No checks or statuses on the default branch head
Source values
Default-branch checks
UnknownGET /repos/{o}/{r}/commits/{sha}/status · 19 Oct 2026, 05:16 UTC
Method
commit-statusGitHub · 19 Oct 2026, 05:16 UTC
Adoption
Weight 5
82Healthy
Source values
Weekly downloads
156,446npm (last 7 days) · 19 Oct 2026, 05:16 UTC
Stars (weak signal)
1,356GET /repos/{owner}/{repo} · 19 Oct 2026, 05:16 UTC
Forks (weak signal)
138GET /repos/{owner}/{repo} · 19 Oct 2026, 05:16 UTC
Dependents
Not availableNot collected: no reliable public source without scraping— · 19 Oct 2026, 05:16 UTC

Over time

Trend

No changes since the previous refresh.

2026-W42 RiskyScore 4185% coverage
2026-W43 RiskyScore 4185% coverageShown above

History

Decision log

No decision recorded yet. Status: Evaluating.

Why this verdict

7 concerns5 neutral3 positive

Score 41 from 85% of the weight; 1 hard gate applied.

ConcernNo release and no default-branch commit in the last 365 days.

ConcernOpenSSF Scorecard score is 2.8 out of 10.

ConcernLast commit to the default branch was 2,014 days ago.

ConcernLast tag was 2,759 days ago (v0.5.6).

ConcernNo tags in the last 365 days.

Concern0 people committed in the last 365 days.

ConcernNo security policy (SECURITY.md) was found.

NeutralNo GitHub security advisories published in the last 365 days.

Neutral0 commits in the last 365 days.

NeutralThe project publishes tags but not GitHub Releases, so there are no release notes to read.

NeutralGitHub community profile is 42 percent complete (informational).

Neutral1,356 GitHub stars (a weak signal on its own).

PositiveNone of the 2 known vulnerabilities for jwt-simple (npm) affect the latest version (0.5.6).

PositiveLicensed under MIT (OSI-approved).

Positive156,446 downloads last week on npm.

Nine dimensions

Security posture

Weight 20

28Risky

Source values

OpenSSF Scorecard: 2.8 / 10OpenSSF Scorecard API · 19 Oct 2026, 05:16 UTC
Scorecard date: 2026-10-12OpenSSF Scorecard API · 19 Oct 2026, 05:16 UTC
Advisories (365 days): 0GET /repos/{o}/{r}/security-advisories · 19 Oct 2026, 05:16 UTC

Known vulnerabilities

Weight 15

100Healthy

Source values

Package: npm: jwt-simpleEntered in admin
Latest version: 0.5.6registry.npmjs.org · 19 Oct 2026, 05:16 UTC
Known vulnerabilities (all versions): 2OSV.dev POST /v1/query · 19 Oct 2026, 05:16 UTC
With a fixed version: 2OSV.dev POST /v1/query · 19 Oct 2026, 05:16 UTC
Affecting the latest version: 0queried with 0.5.6OSV.dev POST /v1/query · 19 Oct 2026, 05:16 UTC
Published in last 365 days: 0OSV.dev POST /v1/query · 19 Oct 2026, 05:16 UTC
Most recent published: 2019-06-06OSV.dev POST /v1/query · 19 Oct 2026, 05:16 UTC

Maintenance

Weight 15

5Risky

Source values

Archived: NoGET /repos/{owner}/{repo} · 19 Oct 2026, 05:16 UTC
Disabled: NoGET /repos/{owner}/{repo} · 19 Oct 2026, 05:16 UTC
Days since last default-branch commit: 2,014 daysGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:16 UTC
Commits in last 365 days: 0GET /repos/{o}/{r}/commits · 19 Oct 2026, 05:16 UTC

Release cadence

Weight 10

10Risky

from tags (no GitHub Releases)

Source values

Days since last release: 2,759 daysBased on the 10 highest-version tags (no GitHub Releases)GET /repos/{o}/{r}/tags + commit dates · 19 Oct 2026, 05:16 UTC
Releases in last 365 days: 0Based on the 10 highest-version tags (no GitHub Releases)GET /repos/{o}/{r}/tags + commit dates · 19 Oct 2026, 05:16 UTC
Median days between releases (2 years): Not availableFewer than 3 releases in the last 2 yearsGET /repos/{o}/{r}/tags + commit dates · 19 Oct 2026, 05:16 UTC
Uses GitHub Releases: No, tags onlyGET /repos/{o}/{r}/tags + commit dates · 19 Oct 2026, 05:16 UTC
Latest release: v0.5.6GET /repos/{o}/{r}/tags + commit dates · 19 Oct 2026, 05:16 UTC

Responsiveness

Weight 10

—No data

Insufficient data: Only 1 recent issues or PRs to sample

Source values

Issues sampled: 1issues updated in the last 90 days, PRs excluded, bots excludedGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:16 UTC
Pull requests sampled: 0pull requests updated in the last 90 days, bots excludedGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:16 UTC
Median time to first response: Not availableNo sampled item had a response from someone other than its authorGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:16 UTC
Share with a maintainer response: 0%sampledGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:16 UTC

Maintainer depth

Weight 10

20Risky

Partial data: contributor count only

Source values

Distinct contributors (365 days): 0GET /repos/{o}/{r}/commits · 19 Oct 2026, 05:16 UTC
Top contributor's share of commits: Not availableNo commits in the last 365 daysGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:16 UTC
Top contributor: Not availableunavailableGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:16 UTC
Low bus factor: Not availableunavailableGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:16 UTC

Governance and licensing

Weight 10

60Watch

Source values

License (SPDX): MITGET /repos/{owner}/{repo} · 19 Oct 2026, 05:16 UTC
License status: OSI-approvedGET /repos/{owner}/{repo} + OSI list · 19 Oct 2026, 05:16 UTC
Security policy: NoGET /repos/{o}/{r}/contents/SECURITY.md (+ .github/, docs/) · 19 Oct 2026, 05:16 UTC
Code of conduct (info): NoGET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:16 UTC
Contributing guide (info): NoGET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:16 UTC
Issue templates (info): NoGET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:16 UTC
Community profile (info): 42%GET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:16 UTC

CI health

Weight 5

—No data

Insufficient data: No checks or statuses on the default branch head

Source values

Default-branch checks: UnknownGET /repos/{o}/{r}/commits/{sha}/status · 19 Oct 2026, 05:16 UTC
Method: commit-statusGitHub · 19 Oct 2026, 05:16 UTC

Adoption

Weight 5

82Healthy

Source values

Weekly downloads: 156,446npm (last 7 days) · 19 Oct 2026, 05:16 UTC
Stars (weak signal): 1,356GET /repos/{owner}/{repo} · 19 Oct 2026, 05:16 UTC
Forks (weak signal): 138GET /repos/{owner}/{repo} · 19 Oct 2026, 05:16 UTC
Dependents: Not availableNot collected: no reliable public source without scraping— · 19 Oct 2026, 05:16 UTC