@scalar/api-client

Dependency profilecaution

The package declares 31 runtime dependencies, including a broad set of UI and Scalar modules; this is a meaningful dependency surface but is consistent with a feature-rich API client.

Maintainerscaution

Five of seven publishing accounts use the scalar.com domain, and the organization-backed project provides continuity. The outside-domain accounts hwkr (hwkr.me) and hanspagel (hanspagel.com) are account-hygiene cautions, not evidence of limited maintenance capacity.

Repo package mentioncaution

The repository name does not match @scalar/api-client and its README does not mention the package, so the package-to-repository relationship is less transparent despite the shared Scalar organization.

Workflow auditcaution

All 23 workflows were analyzed, use read-only permissions, and pin all 166 action references. However, high-confidence blanket GitHub App permissions, repeated secrets inheritance, and ad hoc package installation create workflow hygiene concerns; the trusted-publishing findings are informational here and the release itself has GitHub npm provenance.