@img/sharp-libvips-linux-arm

Licensecaution

The manifest declares LGPL-3.0-or-later, while the repository license file is detected as Apache-2.0. That mismatch creates a real licensing-clarity concern even though licensing information is present.

Repo package mentioncaution

The repository name does not match the package and its README does not mention this package, creating some uncertainty about package-to-repository ownership. The package appears to be one platform-specific component of a broader repository, which partly offsets the mismatch.

Security policycaution

The repository has no published security policy. This is a transparency gap, although the active maintenance and dependency tooling partly compensate for it.