I find it strange. Github says 99% of the code is Go and 1% Makefile. Yet I see a package.json and a yarn.lock. I am not sure to which degree this relies on the NPM ecosystem. Probably I wouldn't want to use it for secrets, if it uses NPM ecosystem in any runtime processes. Perhaps the NPM stuff is merely for development utils?