@solana/rpc-transformers

Workflow auditdanger

All 13 workflows were analyzed, but one pull_request_target workflow performs an untrusted checkout, and high-confidence template-injection and broad GitHub App token findings affect publishing or automation paths. Three uses are unpinned, adding a smaller reproducibility concern.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, so the linkage is less transparent; the organization-owned monorepo context partly explains the mismatch but does not remove the caution.