@peculiar/asn1-pkcs8

Repo package mentioncaution

The repository name does not match the package and its README does not mention @peculiar/asn1-pkcs8, creating a transparency concern even though the package is plausibly a monorepo subpackage.

Repo toolingcaution

The project uses TypeScript, Vitest, and npm scripts for builds and tests; no security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response procedures.

Workflow auditcaution

All 9 action references are unpinned, and the release workflow has three high-confidence template-injection findings; there are no untrusted checkouts or broad top-level write permissions, so this is a meaningful hygiene concern rather than a standalone critical risk.