pbkdf2

Build provenancecaution

Staged publishing with an approver provides some process control, but no build attestation is available, leaving publication provenance less transparent.

Dependency profilecaution

Six runtime dependencies form a moderate dependency surface for a cryptographic compatibility library; this adds some transitive maintenance exposure but is not excessive on its own.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful sign of currently quiet maintenance despite the recent release history.

Repo toolingcaution

TypeScript build tooling is present, but no security scanning tools were detected, leaving a modest repository-hygiene gap.

Workflow auditcaution

All six workflows were analyzed with no audit findings and no untrusted checkouts or script-injection sinks. However, all six action references are unpinned, which weakens build reproducibility and supply-chain hygiene.