libresign/pdf-signature-validator

Lifecycle scriptscaution

post-install-cmd and post-update-cmd scripts execute during dependency operations, increasing install-time review requirements even though no specific malicious behavior is established here.

Release historycaution

Nine releases in 133 days, all within the last 12 months, indicate active publication; however, the short history and roughly 11-hour median release interval show limited maturity and a rapidly evolving package.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers over the last 3 months, which is a meaningful maintenance-ownership gap; recent releases and 11 merged pull requests provide some counterevidence but do not fully resolve it.

Repo popularitycaution

The repository has only 1 star, 0 forks, and 0 watchers, so there is little external adoption evidence; this limits validation but is not by itself evidence of poor maintenance.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response procedures for a package that validates signatures.