@capacitor/core

Maintainerscaution

The organization-backed package has 11 publishers on the primary company domain, compensating for the four consumer Gmail accounts and five outside-domain accounts, which remain an account-hygiene caution.

Repo toolingcaution

The project uses Nx and npm scripts, but no security scanning tools were detected; this is a minor transparency and hygiene gap rather than an abandonment concern.

Workflow auditcaution

The audit analyzed all 14 workflows with no untrusted checkout or script-injection findings, but all 40 action references are unpinned and eight publishing workflows use top-level write permissions. High-confidence template-injection findings and one ad hoc package installation add workflow hygiene concerns, though no dangerous trigger was found to corroborate them.