@shikijs/transformers

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, which creates some uncertainty about package-to-repository linkage. The package is nevertheless published under the matching @shikijs namespace and is represented in a large source tree, partly reducing that concern.

Repo toolingcaution

The project uses established build and test tooling, but no security-scanning tools were detected, leaving a modest transparency gap.

Security policycaution

The linked repository has no SECURITY.md or equivalent security policy, so vulnerability reporting and response expectations are less explicit.

Workflow auditcaution

Both workflows were analyzed without untrusted triggers or script injection, but all 13 action references are unpinned and high-confidence adhoc-package findings install packages outside a lockfile. The low-confidence cache-poisoning finding is hygiene rather than a standalone severe risk.