@langchain/langgraph

Lifecycle scriptscaution

A prepublish lifecycle script is present. This is a mild supply-chain hygiene consideration, but the package also has npm provenance and an active repository.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention @langchain/langgraph. A name mismatch can be normal in a monorepo, but the missing README mention leaves the package-to-repository relationship unclear.

Workflow auditcaution

All seven workflows were analyzed with no untrusted checkout or script injection, and all 40 action references are pinned. However, one high-confidence informational finding reports trusted publishing, while three workflows have top-level write permissions; this merits workflow scrutiny despite the otherwise clean audit.