@evershop/evershop

Dependency profilecaution

The package declares 111 runtime dependencies, increasing maintenance and transitive-dependency complexity, but this is consistent with a full e-commerce platform rather than a small utility.

Licensecaution

The manifest declares GPL-3.0, while artifact-detected license text identifies CC-BY-4.0 and Apache-2.0; the mismatch creates legal transparency risk despite license files being present in both artifact and repository.

Repo toolingcaution

The repository uses TypeScript, SWC, npm scripts, Webpack, and Parcel, but reports no security-scanning tools; the missing scanning layer is a modest transparency and maintenance concern.

Security policycaution

No security policy is present in the repository, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

Both workflows were analyzed with no untrusted checkouts or write-wide permissions, which limits exposure. However, all 14 action references are unpinned, and high-confidence template-injection findings plus low-confidence-independent ad hoc package installs create workflow hygiene concerns.