lob

Dangerous workflowscaution

One of three workflows uses pull_request_target, which warrants caution because that trigger can expose privileged workflow context to pull-request handling; no untrusted checkout or script-injection patterns were detected.

Repo toolingcaution

The repository reports no build tools and no security scanning tools. This is a transparency and defensive-hygiene gap, although the package still has active workflows and npm provenance.

Security policycaution

No repository security policy was found, reducing vulnerability-reporting transparency and maintenance hygiene.

Token permissionscaution

Two workflows lack top-level permissions and one publish workflow grants top-level write permissions. Explicit least-privilege declarations would be safer, though the signal does not show an exploit by itself.

Type declarationscaution

No type declarations are included. This is a usability gap for TypeScript consumers, though the package is a JavaScript API wrapper and its README explicitly points new projects toward a separate TypeScript SDK.