tweetnacl

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is recorded. This limits publication transparency, although the package's small, dependency-free artifact reduces the practical impact.

Release historycaution

The package has 26 releases over more than 12 years, but its latest registry release was in February 2020 and there were no releases in the last 12 months. This is a meaningful maintenance concern, partly offset by the linked repository being updated more recently.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months. Combined with no registry releases since 2020, this indicates a slow maintenance cadence, though the repository is not archived and was pushed in August 2025.

Repo toolingcaution

The repository uses npm scripts for builds but reports no security scanning tools. The absence of automated security scanning is a modest oversight gap for a cryptographic library.

Security policycaution

No security policy is present in the repository. For a cryptographic library, this reduces transparency about vulnerability reporting and maintenance response.