@loaders.gl/worker-utils

Licensecaution

The artifact contains a license file, but it was detected as MIT and Apache-2.0 while the manifest declares only MIT; that mismatch warrants caution.

Repo toolingcaution

The project uses TypeScript, Vitest, npm scripts, and Vite for builds and tests. No security scanning tools were detected, but the repository has a security policy and this is a secondary gap.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkouts or script injection, but 46 of 52 action references are unpinned and a high-confidence low-severity audit found ad-hoc package installation; the low-confidence cache findings are hygiene only.