@posthog/types

Licensecaution

The package declares MIT and includes a license file, but artifact detection also found Apache-2.0 text, creating a license-text mismatch that should be clarified.

Maintainerscaution

Eleven publish-access accounts use the posthog.com domain, while several personal-domain accounts and rauln (raulnegron.me) create account-hygiene caution; this does not indicate a small maintenance team.

Workflow auditcaution

All 30 workflows were analyzed, use read-only permissions, and pin all 211 action references. High-confidence findings include blanket GitHub App permissions, spoofable bot conditions, template injection, and ad hoc package installs; the GitHub App permission issue is a concrete release-workflow hygiene concern, though no untrusted checkout or script-injection path was found.