k2gl/sigstore-verify
The package is MIT-licensed, has repository tests and a changelog, and uses Dependabot. Its artifact has no README, but the repository supplies one; dependency and install-time behavior are straightforward.
68%
Total Score
75
50
100
100
Health Score Breakdown
Seven runtime dependencies, including cryptographic and trust-related libraries, create meaningful transitive maintenance exposure, but the profile is explicit and not unusually broad for this verifier.
The repository is owned by an individual rather than an organization, so the concentrated contributor activity is not offset by visible organizational maintenance capacity.
One contributor made all 16 commits in the last three months, leaving the project dependent on a single active maintainer and creating a meaningful handoff risk.
All six workflows were analyzed successfully, with no untrusted checkout or script-injection findings. However, a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow, and five of ten action references are unpinned, creating CI hygiene and review concerns.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Nick Harin |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 k2gl/tuf Version ^1.0 | — | — |
k2gl/signed-note Version ^1.1 | — | — |
phpseclib/phpseclib Version ^3.0 || ^4.0 | — | — |
k2gl/in-toto-attestation Version ^1.0 | — | — |
Weekly Downloads
Info
- Last Published
- 9 days ago
- Created
- 3 months ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.