@verdaccio/file-locking

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package, creating some uncertainty about the exact package-to-source linkage. The Verdaccio organization backing and package README provide partial context but do not remove that gap.

Workflow auditcaution

All 18 workflows were analyzed, all 79 action references are pinned, and no untrusted checkout or script-injection trigger was found. However, three high-confidence template-injection findings and use of trusted publishing with long-lived credentials warrant workflow hygiene caution; top-level write permissions appear in two workflows.