@electric-sql/pglite-tools

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package. While a name mismatch is normal for a monorepo, the missing README mention leaves package ownership less explicit.

Repo toolingcaution

The repository uses TypeScript, npm scripts, and tsup for its build, but no security-scanning tools were detected. The established build tooling is positive, while the missing scanning is a minor transparency gap.

Security policycaution

No repository security policy was found. This does not show a defect in the release, but it reduces transparency about how vulnerabilities are reported and handled.

Workflow auditcaution

The workflow audit completed cleanly with no untrusted checkouts, script injections, or audit findings, but the workflow has top-level write permissions and all 93 action references are unpinned. Those choices weaken CI supply-chain hygiene without showing an active exploit path.