@rspack/binding

Package scaffoldingcaution

The package includes a README, but it explicitly calls this an internal binding, says not to use it directly, and notes that it does not follow semantic versioning; repository tests provide some project-level compensation.

Repo package mentioncaution

The linked monorepo neither matches the package name nor mentions it in its README, which makes package ownership less transparent; the monorepo context partially explains the mismatch but does not remove the gap.

Repo toolingcaution

The project uses established build tooling, but no security-scanning tools were detected; this is a minor transparency gap outweighed by its active development and provenance.

Workflow auditcaution

All 24 workflows were analyzed and all 59 action references are pinned, but high-confidence template-injection findings, a workflow_run job with an untrusted checkout, inherited secrets, and ad hoc package installs warrant caution. The reported template-injection paths differ from the untrusted-checkout path, so this is not treated as a standalone severe risk.