tempest/cryptography

This is a healthy, actively maintained release with strong recent release cadence, stable versioning, an unarchived organization-owned repository, a clear MIT license, a focused dependency profile, and recent activity from five contributors. The main concerns are highly concentrated commit activity, absent repository security scanning and security policy, and the linked repository not clearly matching or mentioning the package; these reduce transparency and resilience but are partly offset by the organization backing, active commits, and repository tests. The package appears reasonable to depend on, with normal supply-chain diligence recommended.

Latest v3.19.2

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

Commit activity is highly concentrated: one contributor made 47 of 51 commits, or about 92%. Organization ownership and four additional active contributors provide some handoff capacity, but the concentration remains a resilience concern.

Repo package mention

The repository name does not exactly match the package name, and the README mention value is null, so the package-to-repository relationship is not fully demonstrated by this signal. The repository URL is nevertheless specifically named for Tempest cryptography, making this a limited rather than severe concern.

Repo popularity

The repository reports zero stars, forks, and watchers. This provides no supporting adoption evidence, but popularity is not decisive and the active release and commit signals are stronger indicators here.

Repo tooling

Composer is used as a build tool, but no security scanning tools are configured, leaving a security-process gap for a cryptography package.

Security policy

The repository has no security policy, which is a transparency and vulnerability-reporting gap for a package implementing encryption, signing, and password hashing.