@solana/spl-token

Release historycaution

The package has existed for about 6 years and has 54 releases, but only one release appeared in the last 12 months. Active repository work partly offsets the slower registry cadence, so this is a modest maintenance caution.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention @solana/spl-token. This creates some uncertainty about the package-to-repository linkage, although the package is located in a repository with a matching legacy JavaScript client tree.

Workflow auditcaution

All four workflows were analyzed with no untrusted checkouts or script injection, but all 9 action references are unpinned and two publishing workflows inherit secrets. These are meaningful CI hygiene concerns without a dangerous trigger-and-sink combination.