@peculiar/asn1-csr

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, so the package-to-repository link is indirect. Because this is an organization-owned monorepo, the mismatch is plausible but still reduces transparency.

Repo toolingcaution

The project uses TypeScript, Vitest, and npm scripts, but no security-scanning tools were detected. The build tooling is solid; the missing scanning is a modest hygiene gap.

Security policycaution

No repository security policy was found. This reduces transparency for reporting vulnerabilities, although active maintenance and organization backing partly compensate.

Workflow auditcaution

All nine analyzed action references are unpinned, which weakens build reproducibility. The audit also found high-confidence template-injection patterns in release.yml; under the stated rules these are workflow hygiene concerns without an untrusted trigger or sink.