@swc/core-linux-x64-musl

Licensecaution

The artifact includes a recognized Apache-2.0 license file, but the manifest declares Apache-2.0 AND MIT, so the detected license does not fully match the declaration.

Repo package mentioncaution

The linked repository is a monorepo whose name does not match this platform package, but it also does not mention the package in its README, leaving a modest repository-association transparency gap.

Workflow auditcaution

All 16 workflows use read-only permissions and all 128 analyzed action references are pinned. Medium-confidence template-injection findings and high-confidence ad hoc package installs are hygiene concerns, but no untrusted checkout or script-injection sink was found.