minishlink/web-push

Dependency profilecaution

The package has 14 runtime dependencies, including several HTTP and cryptographic components; this is a meaningful integration surface but not, by itself, evidence of abandonment or unsafe maintenance.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations less transparent for a security-sensitive web-push library.

Workflow auditcaution

The single workflow was fully analyzed and has no untrusted checkout or script-injection path, but all four action references are unpinned and a high-confidence audit finding reports installation outside a lockfile; the cache findings are low-confidence hygiene concerns.