@npmcli/arborist

Repo package mentioncaution

The repository name does not match the package and its README does not mention it. Although a monorepo mismatch is ordinary, the absence of both identifiers leaves package-to-source provenance less transparent.

Workflow auditcaution

All 133 analyzed action references are unpinned, creating reproducibility and action-tampering hygiene concerns. The audit also reports high-confidence template-injection findings, but no untrusted checkout or script-injection sink was reported alongside the pull_request_target workflow, so this does not establish a severe workflow risk on its own.