dazza-dev/sri-signer

The repository has had no commits in about 11 months and provides no security policy or automated security scanning. Its focused eight-file structure, MIT declaration, README, stable version, and lack of install scripts keep the concerns moderate.

Latest v1.0.0

Packagist

55%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

One registry maintainer is a thin publishing base for a user-owned project, leaving limited visible redundancy if that maintainer becomes unavailable. The linked repository does match the package and is not presented as organization-backed.

Project backing

The repository is owned by a user account rather than an organization, so there is no observed organizational backing to compensate for the single-maintainer and inactive-project signals.

Release history

This is the package's only release, published about 11 months ago, so there is little evidence of an established maintenance cadence. Its stable v1.0.0 status partly offsets the package's young history but does not demonstrate ongoing support.

Repo commit activity

There were zero commits and zero active maintainers during the last three months, following the only release about 11 months ago. That makes ongoing maintenance unproven and raises abandonment risk.

Repo popularity

The repository has two stars, one fork, and no watchers, indicating limited external adoption or review. Popularity is supporting evidence only, so this modestly reinforces the maintenance concern rather than deciding the verdict.