@simplewebauthn/server

Dependency profilecaution

Ten runtime dependencies create a meaningful dependency surface for a security-sensitive server library, though the profile is still a finite, explicit set rather than an unusually broad tree.

Maintainerscaution

Only one registry account has publish access. This is a limited publishing bus factor, although the active repository and provenance attestations provide some compensation.

Project backingcaution

The package is linked to a user-owned repository rather than an organization account, so its continuity depends more directly on the individual project owner.

Security policycaution

The linked repository has no security policy, leaving vulnerability-reporting and disclosure expectations undocumented.

Workflow auditcaution

All three workflows were analyzed with no high- or medium-severity findings, and two scope permissions at job level; however, all 12 action references are unpinned and two release workflows install packages outside a lockfile.