@turbo/darwin-64

Name lookalikedanger

The package has complete artifact overlap with `turbo`, explicitly identifies as that package, and borrows its identity; consumers most likely wanted `turbo` itself rather than an unrelated package. Its platform-specific binary role and linked Turborepo repository provide context, but do not remove the selection risk.

Repo package mentioncaution

The linked repository name does not match this package and its README does not mention `@turbo/darwin-64`, which creates package-ownership ambiguity. The platform-binary README and organization-backed Turborepo context partly explain the mismatch.

Workflow auditcaution

All 12 workflows were analyzed and all 73 action references are pinned, with 11 workflows using read-only permissions. High-confidence template injection, inherited secrets, ad hoc package installs, and trusted-publishing findings remain workflow hygiene concerns, although no untrusted checkout or script-injection sink was found.