@peculiar/asn1-cms

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, creating some uncertainty about package-to-repository alignment; the package is visibly part of a larger monorepo, which partly explains the mismatch.

Repo toolingcaution

The project uses TypeScript, Vitest, and npm build tooling, but no security-scanning tools were detected; this is a modest transparency gap rather than a release blocker.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting and response expectations undocumented.

Workflow auditcaution

All nine workflow action references are unpinned, and the release workflow has three high-confidence template-injection findings. The workflows have no untrusted checkout or pull_request_target trigger, so these remain workflow-hygiene concerns rather than an independently severe dependency risk.