@peculiar/asn1-rsa

Repo bus factorcaution

One contributor made 87.5% of the 24 recent commits. The organization-owned project and three additional active contributors partly compensate, but concentration remains a maintenance risk.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @peculiar/asn1-rsa. This may reflect a monorepo subpackage, but the absence of a direct mention weakens package-to-source transparency.

Repo toolingcaution

The project uses TypeScript, Vitest, and npm build scripts, but no security scanning tools were detected; the missing scanning is a modest transparency gap.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations unclear for a cryptography-related package.

Workflow auditcaution

All nine action references are unpinned, which weakens build reproducibility. The audit also found high-confidence template-injection findings, but no untrusted checkout, script injection, dangerous trigger, or broad top-level write permissions, so this is a hygiene concern rather than a severe workflow risk.