@yarnpkg/fslib

Repo toolingcaution

The project uses established build tools, although no security-scanning tools were detected; the repository's separate security policy partly offsets that gap.

Workflow auditcaution

The audit found one high-confidence template-injection finding, 44 of 45 action references unpinned, and incomplete analysis of five workflows. The pull_request_target workflow's untrusted checkout is in a different path from the template-injection finding, so it is not treated as the same combined exploit.