@shikijs/core

Repo package mentioncaution

The repository name does not match the package and its README does not mention @shikijs/core, which creates a package-to-repository transparency concern. However, the organization-backed repository structure and package README identify it as a core Shiki package, partly compensating for the monorepo naming mismatch.

Repo toolingcaution

The project uses an established TypeScript and test/build toolchain. No repository security-scanning tool was detected, leaving a modest transparency gap.

Security policycaution

The linked repository has no SECURITY.md or other detected security policy. This does not indicate abandonment, but it weakens vulnerability-reporting transparency.

Workflow auditcaution

All 13 analyzed action references are unpinned, and high-confidence adhoc-package findings show installs outside a lockfile; these weaken workflow reproducibility. The low-confidence cache-poisoning finding is hygiene only, while no untrusted checkout or script-injection path was found.