@cloudflare/workers-types

Maintainerscaution

Three of four publishing accounts use cloudflare.com, consistent with the organization-backed project. dash_service_account uses cloudflare-ui.com, an outside-domain publishing identity that creates a small account-hygiene concern but does not indicate limited maintenance capacity.

Repo package mentioncaution

The linked repository is named workerd and neither matches @cloudflare/workers-types nor mentions the package in its README. This may reflect a monorepo relationship, but the package-to-repository link is less transparent.

Workflow auditcaution

All 24 workflows were analyzed without failures, and no untrusted checkout or script-injection sink was found alongside the pull_request_target triggers. However, 62 of 67 action references are unpinned, with additional high-confidence template-injection and unpinned-image findings; these are workflow hygiene concerns rather than a demonstrated package-health failure.