@protobufjs/utf8

Repo package mentioncaution

The repository name differs from the package name and its README does not mention @protobufjs/utf8, so the package-to-source relationship is less transparent, although the organization backing is consistent.

Workflow auditcaution

All 12 analyzed action references are unpinned, and the release workflow has top-level write permissions; the audit also found high-severity cache-poisoning with low confidence and two high-confidence adhoc-package findings. No untrusted checkout or script injection was detected, so this is a hygiene caution rather than a severe workflow risk.