@hono/node-ws

Package scaffoldingdanger

The package includes a README, changelog, and release notes, but the README explicitly marks this package as deprecated and directs users to @hono/node-server. That makes continued adoption a significant liability despite good documentation.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, creating some uncertainty about package-specific ownership even though a monorepo can legitimately contain subpackages.

Security policycaution

The linked repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.

Workflow auditcaution

All eight workflows were analyzed, use read-only permissions, and pin all 54 action references. Low-confidence cache-poisoning findings and medium-confidence template-injection findings remain workflow hygiene concerns.