@appium/base-plugin

Repo package mentioncaution

The repository name does not match the package and its README does not mention @appium/base-plugin, so package ownership is less transparent. The package tree and organization backing make a monorepo subpackage plausible, but the missing explicit mention remains a caution.

Repo toolingcaution

The repository uses TypeScript, Gulp, Nx, and npm scripts for builds, showing an established build process. No security scanning tools were detected, which is a modest hygiene gap but not evidence of abandonment.

Workflow auditcaution

All 16 workflows were analyzed with no untrusted checkout or script-injection findings, but all 33 action references are unpinned and high-confidence template-injection findings affect manual release and version workflows. Top-level write permissions in two workflows add exposure, while the low-confidence cache finding is only hygiene.