@lerna/child-process

Release historycaution

The package has had no registry release in nearly three years, which raises freshness and abandonment concerns for a dependency. Its 95 historical releases and active source repository partly offset that concern.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention @lerna/child-process, so the package-to-source association is less transparent. The Lerna monorepo context makes a name mismatch ordinary, but the missing README mention remains a caution.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations less transparent.

Workflow auditcaution

All seven workflows were analyzed and action references are pinned, with six workflows using read-only permissions. High-confidence unsound-contains and template-injection findings, plus ad hoc package installs, are workflow hygiene concerns; no untrusted checkout or script-injection sink was found, and the one top-level write workflow is not dangerous on its own.