@napi-rs/wasm-runtime

Repo package mentioncaution

The repository name does not match the package and its README does not mention @napi-rs/wasm-runtime. Although a name mismatch is normal for a monorepo, the absence of both signals creates a package-to-repository mapping concern.

Repo toolingcaution

The project uses TypeScript, npm scripts, and esbuild, and has a build tool. No security scanning tools were detected, which is a modest hygiene gap, but other repository controls provide some compensation.

Workflow auditcaution

All seven workflows were analyzed with no untrusted checkout or script-injection findings. However, 132 of 135 action uses are unpinned, and a high-confidence low-severity finding reports an ad hoc package installation; these weaken workflow reproducibility and hygiene.