arktype

Maintainerscaution

Only one account has registry publish access, which is a publishing concentration concern, but the organization-owned repository shows a broader active contributor base that partly compensates.

Repo toolingcaution

The project uses TypeScript, npm scripts, and tsup, but no security-scanning tools were detected; the repository's security policy and workflow audit provide partial compensation.

Workflow auditcaution

All three workflows were analyzed without failures, and no untrusted checkout or script-injection sinks were found. However, all 11 action references are unpinned, two workflows grant top-level write permissions, and a high-confidence audit found ad hoc package installation; the medium-confidence template-injection finding is hygiene because no dangerous trigger was present.