The package includes tests, a readable README, a matching MIT license, and no install-time scripts. Its repository has had no commits in over eight years, with no recent maintainers, no security policy, and no security scanning; pinning this old release leaves maintenance and support risk.
45%
Total Score
33
100
71
83
The latest release was published in July 2017, and there were no releases in the last 12 months. This long release gap materially increases abandonment and compatibility risk.
The repository recorded zero commits and zero active maintainers in the last three months, consistent with the package having received no updates since 2017. That is a substantial maintenance concern for an encryption library.
The repository is owned by an individual user rather than an organization. Combined with the lack of recent commits, this gives limited evidence of ongoing project capacity.
There are no open issues or pull requests and no recent issue or pull-request activity. The clean tracker is not evidence of active maintenance and provides little support for continued upkeep.
The repository has three stars and one fork, indicating a small user and contributor base. Popularity is supporting evidence only, but this thin adoption provides little evidence of durable project backing.
We didn't find any vulnerabilities for this package.
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
indigophp/hash-compat Version ^1.1 | — | — |
paragonie/random_compat Version ~1.4|~2.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.