@stream-io/node-sdk

It also ships type declarations, release notes, and npm provenance, with a small runtime dependency set. Workflow permissions and unpinned actions need attention, while the missing package-name reference makes repository ownership less transparent.

Latest 0.8.10

NPM

82%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Attestations

100

Health Score Breakdown

Lifecycle scripts

The package defines postinstall and prepack scripts, which add installation and packaging behavior that consumers should understand before adoption.

Repo package mention

The repository name does not match the package name and its README does not mention @stream-io/node-sdk, so the package-to-source relationship is less transparent despite the organization backing it.

Repo tooling

The project uses TypeScript, Vite, and npm scripts, but no security scanning tools were detected; that is a modest repository-hygiene gap rather than an adoption blocker.

Security policy

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.

Workflow audit

All five workflows were analyzed without untrusted checkouts or script injection, but all 13 action references are unpinned, two workflows grant top-level write permissions, and one archived action was found. These are workflow-hygiene concerns, not evidence of an unsafe release on their own.