@cloudflare/vite-plugin

Licensecaution

The package declares MIT, while the repository license file is detected as Apache-2.0; this mismatch creates a real licensing clarification need despite both being recognized open-source licenses.

Workflow auditcaution

All 29 workflows were analyzed with no unpinned actions, but two workflows check out untrusted code and the auditor found a medium-confidence high-severity bot-condition issue, plus two high-confidence ad hoc package installations; these are workflow hygiene concerns rather than evidence that the release itself is unsafe.