koa

Lifecycle scriptscaution

The package has a prepare lifecycle script, which adds install-time execution surface. No provided evidence indicates that this script is harmful, so this is a limited transparency and supply-chain consideration rather than a severe risk.

Token permissionscaution

One workflow lacks top-level permissions and the npm publishing workflow grants top-level write access. This is a minor workflow-hardening concern, though the separate dangerous-workflow scan found no exploitation patterns.