@typescript/typescript-linux-arm64

Licensecaution

The artifact declares Apache-2.0 and includes license files, but detection also found MIT, CC-BY-4.0, and BSD-3-Clause text that the declaration does not spell out.

Repo package mentioncaution

The repository name does not match this scoped platform package and its README does not mention the exact package, creating a package-to-repository linkage caution; the mismatch can also occur for a monorepo subpackage.

Workflow auditcaution

All 13 workflows were analyzed, all 78 action references are pinned, and no untrusted checkout or script-injection paths were found. Eight workflows use top-level write permissions, while the repeated cache-poisoning findings are low-confidence hygiene warnings rather than confirmed risks.