inngest

Dependency profilecaution

The package has 23 runtime dependencies, which is substantial for an SDK and adds maintenance surface, but the profile is consistent with its broad observability and platform integrations.

Maintainerscaution

The package has six publishing accounts and organization backing, but four accounts use consumer Gmail addresses (djfarrelly, jpwilliams, darwin67, and goodoldneon), creating account-hygiene risk despite the company domain accounts.

Repo toolingcaution

The repository uses build tooling, but no security scanning tools were detected, leaving a modest verification gap.

Security policycaution

The linked repository has no published security policy, reducing transparency about vulnerability reporting and response.

Workflow auditcaution

All six workflows were analyzed and none combine untrusted checkout or script injection with the pull_request_target trigger, but all 35 action references are unpinned and the audit found a high-confidence template-injection issue plus ad hoc package installation. These are workflow hygiene concerns rather than standalone evidence that the release is unfit.