kotlin-stdlib

Repo package mentioncaution

The repository name does not match the Maven package and its README does not mention the package. Although an organization-owned monorepo can legitimately contain subpackages, the missing explicit linkage is still a transparency caution.

Workflow auditcaution

The single analyzed workflow has top-level write permissions and three high-confidence template-injection findings, which warrant workflow hygiene attention. However, it has no pull_request_target or workflow_run trigger, no untrusted checkout or script-injection findings, and its action use is pinned, so this is not a severe supply-chain signal.