@peculiar/x509

Dependency profilecaution

The package has 11 runtime dependencies, mostly related @peculiar ASN.1 components, which is a notable dependency surface for a security-sensitive library but appears coherent with its stated X.509 functionality.

Repo bus factorcaution

Two contributors were active, but the top contributor made about 78% of recent commits, leaving a meaningful concentration risk; organization backing partly mitigates the risk of a single-person dependency.

Repo toolingcaution

The repository uses TypeScript, Rollup, and Vitest for build and test workflows, but no security-scanning tools were detected; the missing scanning is a hygiene gap rather than evidence of abandonment.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response procedures for a cryptographic library.

Token permissionscaution

Two workflows lack top-level permission declarations and the release workflow grants top-level write access, increasing the potential impact of workflow compromise even though no dangerous workflow pattern was detected.