@peculiar/asn1-pfx

Repo toolingcaution

The project uses TypeScript, Vitest, and npm scripts, but no security-scanning tools were detected; this is a modest transparency and hygiene gap.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

The audit covered both workflows and found no untrusted checkouts or script injection, but all 9 action references are unpinned and the release workflow has three high-confidence template-injection findings. The template-injection findings are workflow hygiene concerns here because no dangerous trigger or sink was reported.