@salesforce/sf-plugins-core

Lifecycle scriptscaution

The package uses prepack and prepare scripts, which are normal build and packaging hooks but add install-time execution surface.

Maintainerscaution

Seven publish accounts and a Salesforce primary domain fit the organization-backed project. jimjag (gmail.com), mobify (mobify.com), and lwc-admin (lwcjs.org) are outside-domain accounts, creating a minor account-hygiene concern.

Workflow auditcaution

All eight workflows were analyzed successfully with no untrusted checkout or script-injection findings, but all 15 action references are unpinned and seven high-confidence secrets-inherit findings widen credential exposure in reusable workflows.