@inversifyjs/common

Repo package mentioncaution

The repository name does not match the package and its README does not mention @inversifyjs/common. This may be normal for a monorepo subpackage, but the collected evidence does not explicitly connect the package to that repository.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations less transparent than they could be.

Workflow auditcaution

All 11 workflows were analyzed, but the audit found 11 high-severity findings, including high-confidence template-injection patterns and GitHub App tokens with blanket permissions; no untrusted checkout or script-injection trigger was reported, so this is a meaningful hygiene concern rather than a standalone critical verdict.