@peculiar/asn1-csr

Repo package mentioncaution

The repository name does not match the package and its README does not mention this package, so the package-to-repository relationship is less transparent even though it is part of an organization-owned monorepo.

Security policycaution

The repository has no security policy, leaving disclosure and response expectations undocumented for a package handling certificate-related data.

Workflow auditcaution

All nine action references are unpinned, and the audit found three high-confidence template-injection findings in the release workflow. There are no untrusted checkouts or dangerous triggers, so this is a meaningful hygiene concern rather than a standalone severe risk.