eslint-plugin-turbo

Repo package mentioncaution

The repository name differs from the package and its README does not mention the package, which is a caution because the repository link alone does not explicitly identify this subpackage. The large Turborepo source tree is consistent with a monorepo context.

Workflow auditcaution

All 12 workflows were analyzed with no untrusted checkout or script-injection sinks, and 11 use read-only permissions. High-confidence template injection, inherited secrets, ad hoc package installs, and trusted-publishing usage remain workflow hygiene concerns, while the single top-level write workflow is only a mild caution.