md-editor-v3

Lifecycle scriptscaution

A prepare lifecycle script runs during installation-related workflows, adding execution surface to the package. No evidence here shows that the script is harmful, so this is a limited hygiene concern.

Repo toolingcaution

The project uses TypeScript, Rollup, npm scripts, and Vite, showing an established build process. No security scanning tools were detected, leaving a modest transparency gap.

Workflow auditcaution

All three workflows use top-level write permissions and all seven action references are unpinned, which weakens workflow hardening. However, the audit found no untrusted checkouts, script injection, or other reported dangerous findings.