@types/cors

Release historycaution

The package has a long history and 34 releases, but it has had no registry release in the past 12 months. Active source-repository work partly compensates for the package-level pause.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @types/cors, creating some ownership ambiguity. However, the package README explicitly identifies DefinitelyTyped and the cors definitions path, which partly explains the monorepo layout.

Workflow auditcaution

All seven workflows were analyzed, all 25 action references are pinned, and no untrusted checkouts or script injections were found. Medium-confidence template-injection findings are hygiene concerns, but the absence of dangerous triggers and broad top-level write permissions limits their impact.