@solana/transaction-messages

Workflow auditcaution

The audit found one untrusted checkout in a pull_request_target workflow, six high-confidence findings, and seven workflows with top-level write permissions. The publish workflow's template-injection findings are not shown to share that trigger, so this is a caution rather than a standalone severe verdict; three of 27 action references are unpinned.