@zag-js/file-utils

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package. This is plausible for a monorepo subpackage, but the missing explicit mention leaves package-to-repository linkage less transparent.

Security policycaution

The linked repository has no published security policy, leaving vulnerability-reporting expectations unclear even though other maintenance evidence is strong.

Workflow auditcaution

All three workflows were analyzed with no audit findings or untrusted checkouts, but 8 of 9 action references are unpinned and one workflow grants top-level write permissions; this is a moderate reproducibility and hygiene concern.