@reown/appkit-utils

Dangerous workflowscaution

One of 15 workflows uses pull_request_target, which can require careful review because it runs with elevated trust, though no untrusted checkout or script injection was detected.

Repo package mentioncaution

The repository name differs from the package name and its README does not mention @reown/appkit-utils, so the package-to-repository relationship is less explicit; this can be normal for a monorepo but still reduces transparency.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting guidance less transparent despite other security tooling being present.

Token permissionscaution

Seven workflows lack top-level token permissions and four declare top-level write access, which is weaker least-privilege hygiene for a package publishing repository.

Version stabilitycaution

Version 1.8.24 is a stable major and is not a prerelease, although the recent prerelease share is very high and warrants some caution around release-channel complexity.