@shikijs/engine-oniguruma

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package, so the package-to-repository link is less directly transparent. The organization-backed monorepo context partly explains the mismatch but does not remove the gap.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations less transparent even though other maintenance evidence is strong.

Workflow auditcaution

All 13 action references are unpinned, and the release workflow has top-level write permissions; the audit also found high-severity cache-poisoning with low confidence and repeated high-confidence adhoc-package findings. No untrusted checkout or script-injection paths were found, so this is workflow hygiene rather than a severe dependency risk.