@scure/bip39

Repo bus factorcaution

All 13 recent commits came from one contributor, so maintenance continuity depends heavily on a single person; the individual-owned project backing provides some context but does not remove the risk.

Repo toolingcaution

TypeScript and npm build tooling are present, but no repository security-scanning tools were detected. The separate security policy and workflow audit provide partial compensating transparency.