Package Health/web-secure/password-hashing

web-secure/password-hashing

Tests, a clear MIT license, and a small dependency surface make the package straightforward to inspect. Organization ownership and a clean package structure help, but the lack of security tooling and the very small user base provide little evidence of ongoing care.

Latest v1.3.0

Packagist

42%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

This is the package's only release, published nearly eight years ago, with no releases in the last 12 months. That is strong evidence of abandonment for a security-sensitive library.

Repo commit activity

The repository recorded no commits and no active maintainers in the last three months, consistent with the release history's long inactivity. The repository is not archived, but that does not compensate for the absence of recent work.

Repo popularity

The repository has 1 star, 0 forks, and 0 watchers, offering little supporting evidence of broad review or continued community use. Popularity is secondary, but these numbers reinforce the maintenance concern.

Repo tooling

Composer is used for the build, but no security-scanning tool was detected. The missing scanner is a hygiene gap rather than proof of unsafe code.

Security policy

The repository has no security policy, leaving no stated process for reporting or handling vulnerabilities. This is a meaningful transparency gap for password-hashing software.