@peculiar/asn1-pkcs8

Repo bus factorcaution

Four contributors were active, but one contributor made 87.5% of recent commits; organization backing partly offsets this concentration, so it remains a modest resilience concern.

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package. Although a monorepo name mismatch can be normal, the missing README reference leaves some uncertainty about package ownership.

Repo toolingcaution

The project uses TypeScript, Vitest, and npm scripts, but no security-scanning tools were detected, leaving a security-process gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response.

Workflow auditcaution

All nine action references are unpinned, and the audit found three high-confidence template-injection findings in the release workflow. The workflows were fully analyzed and have no untrusted checkout or script-injection findings, so this is a hygiene concern rather than a standalone severe risk.