@sveltejs/load-config

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, leaving some uncertainty about package-to-source alignment; this may reflect a monorepo subpackage but is not confirmed by the signal.

Repo toolingcaution

TypeScript and npm build tooling are present, but no security-scanning tools were detected; the repository's security policy partly compensates for that gap.

Version stabilitycaution

Version 0.2.3 is not a stable-major release, so the API may still change despite the absence of prerelease versions.

Workflow auditcaution

All 16 analyzed action references are unpinned, and a high-confidence template-injection finding affects a deployment workflow; the audit otherwise found no untrusted checkout or script-injection trigger, limiting the severity.