@hubspot/api-client

Licensecaution

The manifest declares ISC while the artifact license file is recognized as Apache-2.0; although both the artifact and repository contain license files, the mismatch creates a real licensing transparency concern.

Lifecycle scriptscaution

A prepare install-time script is present; this is a mild packaging and supply-chain consideration, though no dangerous behavior is shown by this signal alone.

Repo toolingcaution

The project uses TypeScript and npm build tooling, but no security scanning tools were detected; the missing scanning is a modest transparency gap rather than evidence of abandonment.

Workflow auditcaution

All three workflows were analyzed without untrusted checkouts, script injection, or broad top-level write permissions. One high-confidence, low-severity finding reports a package installed outside a lockfile, so workflow hygiene is slightly weaker but not a severe risk.