@streamdown/math

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, creating some uncertainty about the package-to-repository link; the organization-backed repository and monorepo context partly compensate.

Workflow auditcaution

All four workflows were analyzed, but all 11 action references are unpinned, three workflows grant top-level write permissions, and a high-confidence release workflow finding installs a package outside a lockfile. The pull_request_target workflow has no untrusted checkout or script-injection finding, so these are workflow hygiene concerns rather than a severe risk.