lucide-react

Licensecaution

The package declares ISC and includes license files, so it is clearly licensed. The artifact also identifies MIT text alongside ISC, which is a minor declaration mismatch requiring clarification.

Security policycaution

No security policy is published, leaving vulnerability-reporting expectations less transparent despite the repository's active maintenance and Dependabot scanning.

Workflow auditcaution

All 30 workflows were analyzed, use read-only permissions, and pin all 195 action references. High-confidence template-injection, secrets-inherit, and unsound-condition findings, plus ad hoc package installs, are workflow hygiene concerns; low-confidence cache findings add little weight.