@vendure/asset-server-plugin

Maintainerscaution

The package has clear vendure.io publishing backing, but consumer_email_maintainers includes oliverstreissi and outside_domain_maintainers includes michaelbromley and dlhck; organization backing partly compensates for this account hygiene concern.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, creating some uncertainty about package-to-repository alignment; the monorepo context makes a name mismatch ordinary but does not remove the missing mention.

Workflow auditcaution

All 14 workflows were analyzed, actions are fully pinned, and no untrusted checkout or script-injection paths were found. High-confidence findings include a floating container image and an archived action, while the cache findings are low confidence and the remaining issues are lower-impact hygiene.