handsontable

Workflow auditdanger

The audit found high-confidence template-injection and blanket GitHub App permission findings, including in publish workflows, plus one untrusted checkout in a workflow_run-triggered publish workflow; 7 of 37 workflows were not analyzed. All 188 action references are pinned, but the release-path findings materially raise supply-chain risk.

Maintainerscaution

Six registry accounts publish the package, with four using the organization’s handsontable.com domain; the two Gmail accounts, budnix and jansiegel, are account-hygiene cautions, not evidence of low maintenance capacity.

Security policycaution

No repository security policy was found, leaving vulnerability reporting and response expectations less transparent.