@otplib/plugin-crypto

Registry deprecationdanger

NPM marks the package deprecated and explicitly directs users to upgrade to otplib v13. Package-scope deprecation makes this release unfit despite active repository maintenance.

Release historydanger

The package has only four releases, with the latest published more than six years ago and none in the last 12 months. This release line is effectively stale.

Repo bus factorcaution

Two contributors were active recently, but one made about 94% of commits. The second contributor provides limited redundancy, so maintenance remains concentrated.

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package. Although a monorepo can explain the name mismatch, the missing README mention weakens package-to-repository transparency.

Workflow auditcaution

All seven workflows use read-only permissions and all 58 analyzed action references are pinned, with no untrusted checkout or script-injection findings. Two high-confidence template-injection findings remain hygiene concerns, but no dangerous trigger was reported to corroborate them.