@shikijs/langs

Repo package mentioncaution

The repository name does not match this package and its README does not mention @shikijs/langs, creating some uncertainty about package-specific ownership; the package may be a monorepo subpackage, but that is not shown by this signal.

Security policycaution

The linked repository has no security policy, leaving vulnerability-reporting expectations less transparent.

Workflow auditcaution

All 13 analyzed action references are unpinned, and high-confidence adhoc-package findings appear in CI and release workflows; the low-confidence cache finding is hygiene only, while no untrusted checkout or script injection was found.