@inversifyjs/reflect-metadata-utils

Repo package mentioncaution

The repository name does not match the package and its README does not name the package, creating a package-ownership transparency concern; the organization-backed monorepo context makes a subpackage explanation plausible but does not remove the gap.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations undocumented; this is a transparency gap, though active development partly offsets abandonment concerns.

Workflow auditcaution

All 11 workflows were analyzed and references are fully pinned, with no untrusted checkout or script-injection trigger findings. However, seven workflows grant top-level write permissions and high-confidence template-injection and broad GitHub App findings indicate workflow hygiene concerns.