node-opcua-secure-channel

Dependency profilecaution

The package has 20 runtime dependencies, mostly related node-opcua modules, creating a moderately broad dependency surface but a coherent project-local profile.

Maintainerscaution

Only one registry account has publish access, which is a modest publishing continuity concern; the repository is organization-owned, which provides some backing.

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package, creating some uncertainty about the exact package-to-repository link; the organization monorepo context partly reduces that concern.

Repo toolingcaution

The repository uses Make, TypeScript, npm scripts, and tsup for builds, but no security scanning tools were detected; the missing scanning is a hygiene gap rather than abandonment evidence.

Workflow auditcaution

All three workflows were analyzed, but all 32 action references are unpinned and one workflow grants top-level write permissions. High-confidence template-injection findings are present, although no untrusted checkout or dangerous trigger was reported; these are workflow hygiene concerns, not a standalone severe risk.