@cubejs-backend/cubesql

Maintainerscaution

Two of four registry publishers use the cube.dev domain, while keydunov (gmail.com) and statsbot (statsbot.co) are outside-domain accounts. With clear organization backing, this is an account-hygiene concern rather than evidence of limited maintenance capacity.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @cubejs-backend/cubesql, leaving package-to-source ownership less transparent. The name mismatch could be normal for a monorepo, but the absence of a README mention warrants caution.

Workflow auditcaution

All 253 action references are unpinned, which weakens build reproducibility. The audit also found high-confidence template-injection patterns, inherited secrets, archived actions, and ad hoc package installs; however, no untrusted checkout or script injection was found, and the template findings are not shown to share a dangerous trigger.