@peculiar/asn1-x509-attr

Repo package mentioncaution

The repository name does not match the package and its README does not mention this package. The monorepo structure makes the name mismatch ordinary, but the missing README mention leaves some provenance ambiguity.

Repo toolingcaution

The project uses TypeScript, Vitest, and npm scripts, but no security-scanning tools were detected; the established build and test tooling partly offsets that gap.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations and response procedures unclear.

Workflow auditcaution

All nine action references are unpinned, and the release workflow has three high-confidence template-injection findings. The audit was complete, with no untrusted checkout or script-injection findings, so this is a meaningful hygiene concern rather than a standalone severe risk.