pohoc/crypto-sm

Project backingcaution

The package and repository are owned by the same individual account, so the single-contributor concentration is not offset by visible organizational backing.

Repo bus factorcaution

All 17 recent commits came from one contributor, so maintenance depends heavily on a single person despite the active cadence.

Repo popularitycaution

The repository has only 2 stars and no forks or watchers; this is limited supporting evidence, but popularity is not decisive for a small actively maintained package.

Version stabilitycaution

Version v0.3.0 is not a stable-major release, so its API may still change; however, it is not marked as a prerelease and recent releases are consistent.

Workflow auditcaution

All three workflows were analyzed, use read-only permissions, and pin all 10 action references. Two high-confidence medium-severity secrets-inherit findings show reusable workflows receive broader credentials than necessary.