@mongodb-js/saslprep

Repo package mentioncaution

The repository name does not match the package and its README does not mention @mongodb-js/saslprep, so package ownership is less transparent despite the organization match.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting guidance less transparent even though automated security tooling is present.

Workflow auditcaution

All six workflows were analyzed, but four high-confidence low-severity findings report packages installed outside a lockfile; the publish workflow also combines an untrusted checkout with top-level write permissions, warranting workflow hygiene caution.