@storybook/icons

Repo toolingcaution

The project uses established TypeScript, Vite, and tsup build tooling. No security scanning tools were detected, leaving a modest repository hygiene gap.

Security policycaution

No security policy was found in the repository, reducing vulnerability-reporting transparency, although this is not by itself evidence of abandonment.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkouts or script injection, and the project uses trusted publishing. However, the release workflow has a high-confidence finding that an app token inherits blanket installation permissions, creating a meaningful supply-chain hygiene concern; three of seven action references are unpinned.