@yarnpkg/parsers

Release historycaution

The package has a long history with 117 releases, but only one release in the last 12 months indicates a slower current cadence. The latest release is recent and the repository remains active.

Repo toolingcaution

The project uses established build tools, but no security-scanning tools were detected. This is a modest transparency and maintenance gap.

Workflow auditcaution

The audit found a high-confidence template-injection finding and one untrusted checkout, plus 44 of 45 action references are unpinned. The pull_request_target trigger is in a different workflow from the template-injection finding, limiting the combined severity but leaving meaningful CI hygiene risk.