@img/sharp-libvips-linux-arm64

Licensecaution

The manifest declares LGPL-3.0-or-later, while the repository license file was detected as Apache-2.0. The package README documents third-party licenses, but the mismatch remains a transparency concern.

Maintainerscaution

Only one registry publisher account is listed. The repository shows two active contributors, which partly offsets the narrow registry publishing access but does not eliminate concentration risk.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package, so the package’s ownership relationship is less transparent. The broader repository structure suggests a platform-package project, but the missing mention remains a caution.

Security policycaution

The repository has no security policy file. This is a modest transparency gap for reporting and handling vulnerabilities, though active maintenance and Dependabot partly compensate.