@math.gl/core

Licensecaution

The package declares MIT and includes a license file, but the artifact also identifies Apache-2.0, creating a license-coverage mismatch that should be clarified.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting guidance less transparent even though security scanning is present.

Version stabilitycaution

Version 4.1.0 is a stable, non-prerelease major release, although 95% of recent releases were prereleases, which modestly reduces confidence in release stability.

Workflow auditcaution

All three workflows were analyzed, use read-only permissions, and pin all 31 action references. One high-confidence low-severity adhoc-packages finding warrants workflow cleanup; the low-confidence cache findings are hygiene only.