@types/chroma-js

Repo package mentioncaution

The linked repository name does not match this package and its README does not mention it, which creates a package-ownership transparency concern; however, the package README identifies the exact DefinitelyTyped types/chroma-js source path, partly compensating for the monorepo mismatch.

Workflow auditcaution

All seven workflows were analyzed, none use untrusted checkout or script-injection sinks, all 25 action references are pinned, and permissions are mostly read-only. Four medium-confidence template-injection findings remain workflow hygiene concerns, but no dangerous trigger or write-token combination corroborates them.