hermes-compiler

Repo package mentioncaution

The repository name does not match hermes-compiler and its README does not mention the package, so the link does not explicitly establish that this exact registry package is built from the repository. The Hermes source context and package contents are relevant, but this remains a provenance and association caution.

Repo toolingcaution

The repository uses CMake for builds, which is appropriate for this native compiler. No security-scanning tools were detected, leaving a modest security-process hygiene gap.

Token permissionscaution

Nine of 11 workflows lack top-level permissions declarations, which weakens least-privilege clarity even though none declares top-level write permissions and two explicitly use read-only permissions.