@peculiar/webcrypto

Dependency profilecaution

Five runtime dependencies support the package, which is a moderate dependency surface for a cryptography implementation and adds some transitive maintenance exposure.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is a meaningful maintenance warning, although the recent release and push activity provide partial counterevidence.

Repo toolingcaution

The repository uses TypeScript, Rollup, Vitest, and npm scripts, showing a functioning build and test toolchain, but no security-scanning tools were detected.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting and response expectations undocumented for a security-sensitive package.

Workflow auditcaution

Both workflows were analyzed completely, but all 12 action references are unpinned, the publish workflow has top-level write permissions, and a high-confidence template-injection finding was reported. No untrusted checkout or script-injection path was found, so this is workflow hygiene risk rather than a severe standalone dependency verdict.