komputerwiz/secure-token

The repository has seen no commits since January 2018, and it has no security scanning or security policy. It does include tests, a substantial README, a matching source repository, and a clear Apache-2.0 license, but this is a poor fit for new cryptographic dependencies.

Latest 1.1.1

Packagist

38%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The latest release was in January 2018, with no releases in the last 12 months and only three releases overall. This long period without published updates is a substantial abandonment concern for a cryptography library.

Repo commit activity

There were no commits and no active maintainers in the last three months. Combined with the last push in January 2018, this indicates the project is effectively unmaintained.

Project backing

The package and repository are owned by the same individual account, rather than an organization with visible backing. This is not inherently unhealthy, but it offers limited evidence of ongoing project support.

Repo popularity

The repository has one star, no forks, and no watchers, providing little evidence of a broad user or contributor base. Popularity is supporting evidence, but this reinforces the maintenance concern.

Repo tooling

Composer build tooling is present, but no security scanning tools are configured. For a library handling encryption and token integrity, that leaves an important maintenance and review gap.