@loaders.gl/worker-utils

Licensecaution

The package declares MIT and includes a license file, but the artifact also detects Apache-2.0, which is not covered by the declaration and creates a minor licensing transparency concern.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, which would normally raise a provenance concern; the organization-backed loaders.gl monorepo context partly compensates, but does not remove it entirely.

Repo toolingcaution

The project uses TypeScript, Vitest, npm scripts, and Vite, and has a build tool; no security scanning tools were detected, leaving a modest security-process gap.

Workflow auditcaution

All three workflows were analyzed and had no untrusted checkout or script-injection findings, but 46 of 52 action uses are unpinned and a high-confidence adhoc-packages finding installs outside a lockfile. The cache-poisoning findings are low confidence and count only as hygiene concerns.