@discordjs/ws

Repo toolingcaution

The project uses TypeScript, Vitest, tsup, Turbo, and npm scripts, indicating a structured build and test setup; no security-scanning tool was detected, a minor gap.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations less transparent despite the project's active maintenance.

Workflow auditcaution

All 46 action references are unpinned, and the audit found eight high-confidence findings involving template injection and a broadly inherited app token. The pull_request_target workflow had no reported untrusted checkout or script-injection sink, so these are workflow hygiene concerns rather than a standalone severe health verdict.