@otplib/core

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated recent commit activity represents a genuine continuity concern rather than normal organizational delegation.

Repo bus factorcaution

Two contributors were active, but one made 16 of 17 recent commits, leaving maintenance heavily concentrated despite the second contributor's presence.

Workflow auditcaution

All seven workflows were analyzed, all 58 action references are pinned, and permissions are read-only. However, two high-confidence template-injection findings in mutation.yml and tag-release.yml are meaningful workflow hygiene concerns, even though no untrusted checkout or script-injection trigger was detected.