libnpmorg

Repo package mentioncaution

The repository name does not match libnpmorg and its README does not mention the package, creating some uncertainty about package-to-source alignment; the organization-owned monorepo context partly offsets this.

Workflow auditcaution

All 26 workflows were analyzed, but all 133 action references are unpinned and the audit found high-confidence template-injection findings plus top-level write permissions in 4 workflows. The lone pull_request_target workflow has no reported untrusted checkout or script-injection sink, so this is workflow hygiene risk rather than a severe finding.