@solana/subscribable

Repo package mentioncaution

The repository name and README do not mention this package, which creates some provenance ambiguity; the organization-owned monorepo context makes a subpackage mismatch plausible but does not remove the caution.

Version stabilitycaution

Version 8.5.0 is a stable major release rather than a prerelease, although the recent prerelease share is high and warrants some caution about development churn.

Workflow auditcaution

All 13 workflows were analyzed, but one pull_request_target workflow performs an untrusted checkout, seven workflows grant top-level write permissions, and high-confidence template-injection and broad GitHub App findings remain. The trigger and template-injection paths do not clearly coincide, so this is a serious hygiene caution rather than a standalone danger.