ripemd160

Lifecycle scriptscaution

A prepack script runs during packaging. This is not inherently unsafe, but it adds a build step that should be understood when reproducing releases.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Although a release was published during the broader 12-month period, the recent source inactivity is a maintenance concern.

Repo toolingcaution

The repository reports no build tooling and no security scanning tools. For a small pure-JavaScript package this is not disqualifying, but it reduces automated assurance.

Security policycaution

The repository has no security policy. This weakens vulnerability-reporting transparency, though it is partly offset by the package's small scope and mature source repository.

Workflow auditcaution

All six analyzed action references are unpinned, which is a workflow hygiene concern. The two pull_request_target workflows have no untrusted checkouts or script-injection findings, and no high- or medium-severity audit findings were reported.