@loaders.gl/schema

Licensecaution

The package declares MIT and includes a license file, but the detected file also names Apache-2.0, which is not covered by the manifest declaration and creates a modest licensing clarity concern.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention @loaders.gl/schema, so the package-to-repository relationship is less transparent despite the monorepo context.

Repo toolingcaution

The repository uses TypeScript, Vitest, npm scripts, and Vite for builds and tests. No security-scanning tooling was detected, leaving a minor assurance gap.

Workflow auditcaution

The audit completed all three workflows with no untrusted checkouts or script injection. However, 46 of 52 action references are unpinned, and a high-confidence finding shows the release workflow installs a package outside a lockfile; the low-confidence cache findings are hygiene concerns.