@solana/fast-stable-stringify

Repo package mentioncaution

The linked repository name does not match the package name and its README does not mention this package, so the package-to-source relationship is not demonstrated by the collected repository evidence. This is a transparency concern even though monorepo subpackages can legitimately use different names.

Workflow auditcaution

All 13 workflows were analyzed, but one pull_request_target workflow performs an untrusted checkout, and high-confidence template-injection findings appear in the publishing workflow. Seven workflows have top-level write permissions and three of 27 action references are unpinned; these raise CI and publication hygiene concerns, though the data does not establish that every trigger and sink share a workflow.