@napi-rs/canvas-linux-arm64-gnu

Project backingcaution

The repository is owned by an individual rather than an organization, so the small publishing and contributor base has less organizational redundancy.

Repo package mentioncaution

The repository name does not match this platform package and its README does not mention the package, creating some linkage ambiguity; the package's platform-specific naming makes a monorepo relationship plausible but not demonstrated by this signal.

Workflow auditcaution

All 4 workflows were analyzed with no untrusted checkouts or script injection, but all 96 action references are unpinned, and high-confidence audits found lockfile-bypassing package installs; the cache findings were low confidence, so these are workflow hygiene concerns rather than a severe risk.