@solana/kit

Workflow auditdanger

The audit found an untrusted checkout in a pull_request_target workflow, high-confidence template-injection findings in publishing, blanket app-token permissions, and seven workflows with top-level write access. The audit was complete, but these combinations create real workflow supply-chain exposure and warrant remediation.

Dependency profilecaution

Twenty-seven runtime dependencies form a broad dependency surface for an SDK that re-exports and coordinates many @solana modules; this adds maintenance exposure but is coherent with the package's documented role.