@discordjs/collection

Repo toolingcaution

TypeScript, Vitest, tsup, Turbo, and npm scripts provide established build and test tooling, though no security-scanning tool was detected.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations less transparent despite the project's active maintenance.

Workflow auditcaution

All 15 workflows were analyzed, but all 46 action references are unpinned and the audit found high-confidence template-injection issues plus a broadly scoped app token. There were no untrusted checkouts or script-injection findings, so this is a hardening concern rather than a standalone severe verdict.