@scalar/openapi-types

Modern OpenAPI types

Latest 0.9.8

82%

Total Score

healthy

Active releases and strong project backing outweigh workflow credential concerns and the repository’s missing package reference.

Health Score Breakdown

Maintainers

Five of seven publishing accounts use the scalar.com domain, consistent with the organization backing; hwkr (hwkr.me) and hanspagel (hanspagel.com) are outside-domain accounts and add account-hygiene caution, not evidence of a thin maintainer base.

Repo package mention

The repository name does not match the package and its README does not mention @scalar/openapi-types. This can occur for a monorepo subpackage, but the missing explicit reference leaves package ownership less transparent.

Version stability

Version 0.9.8 is not a stable major release, which adds some API-maturity uncertainty, but it is not a prerelease and recent releases show no prerelease share.

Workflow audit

All 23 workflows use read-only permissions and all 167 action references are pinned, but the audit found a high-confidence blanket app-token permission and repeated high-confidence inherited-secret findings; these are real workflow hygiene risks despite no untrusted checkout or script injection.