@connectrpc/connect-node

Dangerous workflowscaution

One of nine workflows uses pull_request_target, creating some privileged workflow risk, but there are no untrusted checkouts or script-injection findings among the analyzed workflows.

Repo bus factorcaution

The top contributor made 80% of recent commits, which creates concentration risk; however, four additional contributors were active and the repository is organization-owned, partly mitigating handoff risk.

Token permissionscaution

Seven workflows declare read-only permissions, while one publish workflow has top-level write permissions as expected for publishing; one administrative workflow lacks top-level permissions, a minor least-privilege gap.