It has a clear MIT license and a small dependency set. The single-file package has no tests or README, while its repository has been inactive since November 2023 and does not clearly identify this package.
43%
Total Score
0
100
57
67
This is the only release, published on November 21, 2023, with no releases in the following 34 months. That long absence of release activity is a substantial maintenance concern.
The repository recorded zero commits and zero active maintainers in the last three months, consistent with the package's prolonged lack of releases and raising abandonment risk.
The artifact and repository each contain only composer files and src/Sign.php. This is a very minimal project surface for a cryptographic library and provides little transparency for consumers.
The package has no README, tests, or changelog, although tests and changelogs are not expected in published artifacts. The missing README still reduces consumer documentation for a library, while the GitHub release for this version is a modest positive.
The linked repository is named walletverify rather than dexcedu/sign, and no README package mention was available. A sub-package explanation is possible, but the repository's ownership of this package is not clear.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
kornrunner/secp256k1 Version ^0.2.0 | — | — |
simplito/elliptic-php Version ^1.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.