node-opcua-address-space

Dependency profilecaution

The package declares 37 runtime dependencies, many from the same node-opcua family. This is a substantial dependency surface, but it is coherent with the package's broad address-space functionality.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package. Although a monorepo can explain the name mismatch, the lack of a README mention leaves some uncertainty that this repository directly represents the package.

Repo toolingcaution

The project uses established build tools, but no security-scanning tools were detected. The missing scanning layer is a modest transparency and hygiene concern.

Workflow auditcaution

All three workflows were analyzed, but all 32 action references are unpinned, one workflow grants top-level write permissions, and high-confidence template-injection findings appear in documentation and publishing workflows. No untrusted checkout or script-injection trigger was reported, limiting the severity to workflow hygiene risk.