browserify-sign

Dependency profilecaution

Nine runtime dependencies create meaningful supply-chain surface area for a cryptographic browser package, though the signal does not show an abnormal or excessive dependency profile by itself.

Repo bus factorcaution

One contributor made 100% of the last three months' commits. Organizational ownership provides some handoff capacity, but no second active contributor is shown.

Repo commit activitycaution

The repository had 3 commits in the last 3 months, showing current activity, but the volume is modest and all activity is concentrated in one contributor.

Security policycaution

The repository has no security policy, leaving reporting and response expectations undocumented for a security-sensitive package.

Workflow auditcaution

All six workflows were analyzed with no audit findings and no untrusted checkout or script-injection paths. However, all six action references are unpinned, which weakens build reproducibility and action supply-chain control.