@intlify/devtools-types

Repo package mentioncaution

The repository name does not match @intlify/devtools-types and its README does not mention the package, creating uncertainty about the package-to-source relationship; the organization backing partly reduces that concern but does not remove it.

Workflow auditcaution

All eight workflows were analyzed and all 40 action references are pinned, but a high-confidence template-injection finding remains in size-data.yml. The two low-confidence cache-poisoning findings are hygiene concerns only, and no untrusted checkout or script-injection sink was detected.