eslint-config-next

Maintainerscaution

Two of three publishing accounts use the organization domain, and the remaining timer account uses gmail.com; this is a minor account-hygiene concern, not evidence of a thin maintenance team.

Repo package mentioncaution

The repository name does not match eslint-config-next and its README does not mention the package, which is a transparency concern; the organization-owned Next.js monorepo context partly explains the subpackage naming.

Workflow auditcaution

All 29 workflows were analyzed with no untrusted checkouts or script-injection findings, and 133 of 134 action references are pinned. However, high-confidence template-injection findings and repeated high-confidence secrets-inherit findings are genuine workflow hygiene concerns; low-confidence cache-poisoning findings add little weight.