@peculiar/asn1-ecc

Repo bus factorcaution

One contributor made 21 of 24 recent commits, creating concentration risk; three additional contributors were active, and organization backing partly reduces handoff risk.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, which weakens proof that the linked monorepo clearly represents this package; the monorepo structure provides some context but does not remove the gap.

Repo toolingcaution

The project uses TypeScript, Vitest, and npm scripts, but no security-scanning tool was detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response.

Workflow auditcaution

All nine action references are unpinned, and the audit found high-confidence template-injection patterns in the release workflow; no untrusted checkout or script-injection sink was detected, so this is workflow hygiene rather than a severe standalone risk.