@langchain/langgraph-sdk

Lifecycle scriptscaution

A prepublish lifecycle script adds some publication-process complexity, but this is limited to one script and is not evidence of an unsafe install hook by itself.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package, which makes package-to-source ownership less transparent even though a monorepo can legitimately contain subpackages.

Workflow auditcaution

All seven workflows were analyzed, all 40 action references are pinned, and no untrusted checkout or script injection was found. The audit still flags high-confidence use-trusted-publishing as a workflow hygiene caution, while the release also has npm provenance.