@noble/ed25519

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-maintainer concentration represents a genuine succession risk rather than normal organizational ownership.

Repo bus factorcaution

All 15 recent commits came from one contributor, creating a real continuity risk if that maintainer becomes unavailable; the active commit rate partly compensates but does not remove the concentration.

Repo toolingcaution

TypeScript and npm build tooling are present, but no security-scanning tools were detected, leaving a modest transparency gap for a cryptographic library.

Token permissionscaution

None of the three workflows declares top-level token permissions, which weakens least-privilege clarity; however, no workflow has top-level write permissions and one uses job-level permissions.