Which has better activity and maintenance signals?

Based on the RepoPilot analysis provided:

mzying2001/cefflashbrowser shows concerning maintenance signals:

• OpenSSF Scorecard: 2.5/10 — critically weak across multiple dimensions
  • CI-Tests: 0/10 (no automated testing infrastructure)
  • Dependency-Update-Tool: 0/10 (no automated dependency updates)
  • Security-Policy: 0/10 (no documented security policy)
• Single-maintainer risk — flagged as a verdict concern
• Architecture grade C (50/100) — modest code organization quality

The analysis notes 0 files parsed in the import graph, which suggests difficulty analyzing the codebase structure, but this may reflect the mixed C#/C++ nature of the project rather than absence of code.

shadowsocks/shadowsocks-windows has better signals but incomplete coverage:

• The RepoPilot analysis is not included in the data provided, so I cannot directly compare its OpenSSF Scorecard or dependency security posture
• However, the presence of a structured CONTRIBUTING.md [CONTRIBUTING.md:L1-L19], appveyor.yml CI configuration [appveyor.yml:L1-L40], and README.md with comprehensive dependency attribution [README.md:L141-L170] suggests more established maintenance practices
• The appveyor.yml shows active build automation with hash calculation and artifact publishing [appveyor.yml:L71-L110]

Conclusion: shadowsocks/shadowsocks-windows demonstrates better maintenance infrastructure (CI/CD, contribution guidelines, documented dependencies), while cefflashbrowser is flagged as a single-maintainer project with minimal automated testing and security governance. For adoption or long-term reliance, shadowsocks-windows presents lower maintenance risk.

FOLLOW_UPS:

• What are cefflashbrowser's actual GitHub activity metrics (commits, issues)?
• Does shadowsocks-windows have recent release history and update frequency?
• What critical dependencies does cefflashbrowser rely on?