@cashu/cashu-ts

Dangerous workflowscaution

One of 16 workflows uses pull_request_target, which warrants review because that trigger can grant elevated repository context. However, no untrusted checkouts or script-injection patterns were detected.

Lifecycle scriptscaution

The package uses a prepare install lifecycle script. This adds some installation complexity and execution surface, but it is not severe on its own and the repository shows established build tooling.

Repo bus factorcaution

One contributor made about 97% of the 218 recent commits, despite 5 active contributors. The organization backing reduces handoff risk, but the concentration still creates a meaningful continuity concern.

Token permissionscaution

Six workflows declare top-level write permissions, ten omit top-level permissions, and none declare read-only permissions. The broad or implicit permission configuration is a repository hygiene concern, though it does not by itself show unsafe behavior.