@zxing/library

Licensecaution

The artifact and repository contain license files, but the detected licenses include BSD-3-Clause while the manifest declares Apache-2.0, leaving a licensing mismatch to clarify.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months. Recent release and pull-request signals show some project movement, but they do not offset the lack of current commit activity.

Security policycaution

The linked repository has no security policy, reducing transparency about how vulnerabilities should be reported and handled.

Workflow auditcaution

All 10 analyzed action references are unpinned and one workflow grants top-level write permissions. The audit also reported low-confidence cache-poisoning patterns; these are workflow-hygiene concerns rather than evidence of an active compromise.