@vue/devtools-core

Repo package mentioncaution

The repository name does not match this package and its README does not mention @vue/devtools-core, so the package-to-repository link is less directly demonstrated; the mismatch could reflect a monorepo subpackage, but the absent mention remains a transparency concern.

Repo toolingcaution

The project uses established build and test tooling, but the collected repository tooling reports no security-scanning tools, leaving a modest assurance gap.

Security policycaution

No repository security policy was found, reducing transparency about how vulnerability reports are handled.

Workflow auditcaution

All four workflows were analyzed with no untrusted checkouts or script injection, but six of seven action references are unpinned and high-confidence adhoc package installs bypass lockfiles; one workflow also grants top-level write access.