@formatjs/ecma402-abstract

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, so the ownership relationship is less transparent despite the matching organization.

Repo toolingcaution

The project uses substantial build tooling, but no security-scanning tools were detected, leaving a modest transparency and hygiene gap.

Security policycaution

No repository security policy was found, reducing guidance for reporting vulnerabilities, though this is a documentation gap rather than evidence of abandonment.

Workflow auditcaution

All 13 workflows were analyzed with no untrusted checkout or script-injection trigger, but 76 of 79 action references are unpinned and the audit found high-confidence template-injection hygiene issues plus an ad hoc package install.