node-opcua-secure-channel

Repo package mentioncaution

The repository name does not match this package and its README does not mention it, creating some uncertainty about package-to-repository identity; the organization repository context partly offsets that concern for a monorepo subpackage.

Repo toolingcaution

The project uses Make, TypeScript, npm scripts, and tsup, but no security scanning tools were detected; the missing scanning is a modest hygiene gap.

Workflow auditcaution

All three workflows were analyzed, but all 32 action references are unpinned, one workflow grants top-level write permissions, and high-confidence template-injection findings appear in docs and publish workflows. The low-confidence cache-poisoning finding is hygiene only, while no untrusted checkout or script-injection trigger was found.