petrknap/data-signer

The repository is not archived, and the package includes a clear README, repository tests, release notes, and explicit licensing. Its small audience, missing security policy, unpinned workflow actions, and stalled recent activity add maintenance and hygiene concerns.

Latest v0.8.0

Packagist

61%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has 10 releases, but none in the last 12 months; its latest release was about 17 months ago. The earlier roughly one-day median interval shows an initially active project but does not offset the current pause.

Repo commit activity

The repository recorded 0 commits and 0 active maintainers in the last 3 months. This is a meaningful maintenance warning, although the repository was pushed more recently according to the separate archive signal.

Repo popularity

The repository has 0 stars, 0 forks, and 1 watcher, so there is little visible community adoption or independent support. Popularity is supporting evidence rather than decisive proof, but it provides no compensating maturity signal here.

Security policy

No security policy was found in the repository. For a library that implements digital signing and verification, this weakens vulnerability-reporting transparency.

Workflow audit

All 3 workflows were analyzed successfully with no injection sinks or audit findings, but all 3 action references are unpinned. The absence of top-level permissions blocks is acceptable on its own, while unpinned actions remain a supply-chain hygiene gap.