@duckdb/node-bindings

Repo toolingcaution

No build tool or security scanning tool was detected in the repository. This weakens maintenance and security-process transparency, although active commits and releases partly compensate.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Version stabilitycaution

The assessed release is a prerelease, and all recent releases are prereleases, which adds some adoption and compatibility risk despite the stable major version.

Workflow auditcaution

The single analyzed workflow is complete and scopes permissions at job level, with no untrusted checkout or script-injection trigger findings. However, all 26 action references are unpinned, and the audit reports high-confidence unpinned container images; these are meaningful workflow hygiene and reproducibility concerns, while template-injection findings alone do not establish a dangerous trigger-and-sink combination.