Package Health/quantificant/http-message-signer

quantificant/http-message-signer

Usable with caveats: the package is licensed, includes tests and documentation, and is not deprecated or archived. However, it remains an early work-in-progress with no registry release in over a year and no commits in the last three months, so avoid it for critical production use without validating maintenance needs.

Latest v0.0.3

Packagist

58%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Project backing

The registry namespace and repository owner differ and the repository is user-owned, but the repository name matches the package and its README explicitly references the package. This provides some provenance support while leaving backing relatively thin.

Release history

Only three releases were published, all within about 12 days, followed by no release in the last 12 months. That limited and stalled release history lowers confidence in ongoing maintenance.

Repo commit activity

There were no commits and no active maintainers in the last three months. Combined with the lack of recent registry releases, this indicates currently stalled development.

Repo popularity

The repository has only 1 star, 3 forks, and 1 watcher. Low adoption is supporting caution rather than a decisive health failure, especially because the package is small and specialized.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. That is a transparency and maintenance gap, though not severe enough to make the package unfit by itself.