@ark/util

Repo package mentioncaution

The repository name does not match @ark/util and its README does not mention the package, which is a transparency concern, although the package is plausibly a monorepo subpackage.

Repo toolingcaution

The project uses TypeScript, npm scripts, and tsup with an explicit build tool, but no security scanning tools were detected; the missing scanning is a modest hygiene gap.

Workflow auditcaution

All three workflows were analyzed, with no untrusted checkouts or script-injection counts, but all 11 action references are unpinned; the audit also found medium-confidence template injection and high-confidence adhoc package installation, creating workflow supply-chain hygiene concerns.