@protobufjs/fetch

Repo package mentioncaution

The repository name does not match the package and its README does not mention @protobufjs/fetch, so the package-to-source relationship is less transparent. The organization-backed monorepo context reduces but does not remove that concern.

Workflow auditcaution

Both workflows were analyzed with no untrusted checkouts or script injection, but all 12 action references are unpinned and both workflows install packages outside a lockfile; the release workflow also has top-level write permissions. These are meaningful workflow-hygiene cautions, while the low-confidence cache finding is not decisive.