magic-string

Repo toolingcaution

The repository uses TypeScript, Vitest, and npm scripts for builds and tests. No security scanning tools were detected, which is a minor transparency gap but not a severe dependency-health concern by itself.

Security policycaution

The repository has no security policy. This modestly reduces vulnerability-reporting transparency, but active maintenance and release activity provide compensating evidence.

Workflow auditcaution

Both analyzed workflows use unpinned action references, a reproducibility and supply-chain hygiene gap. However, the audit found no untrusted checkout, script injection, dangerous trigger, excessive top-level write permission, or other findings.