ethereum-cryptography

Lifecycle scriptscaution

The package uses a prepare lifecycle script, which adds install-time behavior. This is a modest review consideration, but the available build and provenance signals provide context for a source-build step rather than indicating abandonment.

Release historycaution

The package has 35 releases over roughly seven years, but its latest release was about 17 months ago and there were no releases in the last 12 months. That slows confidence in ongoing maintenance for a security-sensitive library.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The recent push and organization backing soften this concern, but the current activity still indicates a maintenance slowdown.

Security policycaution

No repository security policy was found, so the project gives no explicit documented path for reporting vulnerabilities. This matters for a cryptography library, although the repository does include an audit document and security scanning.

Workflow auditcaution

Both workflows were analyzed with no untrusted checkouts or script injection, and all four action references are pinned. A low-confidence cache-poisoning finding and one workflow with top-level write permissions are hygiene concerns, not standalone severe risks.