@unocss/extractor-arbitrary-variants

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package, so package ownership is less transparent. The organization-backed monorepo context makes a subpackage layout plausible but does not remove the gap.

Repo toolingcaution

The repository uses established TypeScript, Vitest, Turbo, Rollup, and Vite tooling, but no security-scanning tools were detected. The active project signals partly compensate for that transparency gap.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations unclear despite the project's active maintenance.

Workflow auditcaution

All five workflows were analyzed, but all 18 action references are unpinned. High-confidence findings also include installing a package outside a lockfile and use of trusted publishing; the low-confidence cache findings are hygiene concerns rather than decisive evidence.