@img/sharp-libvips-linuxmusl-x64

Licensecaution

The manifest declares LGPL-3.0-or-later, while the linked repository license file is detected as Apache-2.0, so the release's licensing information is inconsistent and needs verification.

Maintainerscaution

Only one registry publishing account is listed, but this is partly offset by two active repository contributors and should not be treated as evidence of abandonment.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, so the linkage is less transparent even though the package is clearly presented as part of a broader prebuilt-binary project.

Security policycaution

No repository security policy was found, leaving disclosure and response guidance undocumented. This is a transparency gap, but not evidence of abandonment by itself.

Workflow auditcaution

Both workflows use read-only permissions and the audit completed fully. One low-confidence cache-poisoning finding and one unpinned action are workflow hygiene concerns, not a severe risk on their own.