@peculiar/asn1-android

Repo bus factorcaution

One contributor made 21 of 24 recent commits, leaving maintenance highly concentrated; organization backing and three additional active contributors partly compensate but do not remove the continuity risk.

Repo toolingcaution

The project uses TypeScript, Vitest, and npm scripts, but no security-scanning tooling was detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response.

Workflow auditcaution

The audit found three high-confidence template-injection findings in the release workflow and all 9 action references are unpinned. The workflows were fully analyzed, have no untrusted checkout or script-injection counts, and avoid top-level write permissions, which limits but does not eliminate the release-process concern.