mediasoup

Dangerous workflowscaution

All 12 workflows were analyzed with no pull-request-target or script-injection findings. One workflow checks out untrusted content and three use workflow_run, so CI boundaries still warrant review.

Lifecycle scriptscaution

The package uses postinstall and prepare scripts, which add install-time execution and therefore some supply-chain exposure. The build provenance and extensive repository tooling provide partial reassurance, but do not remove that exposure.

Repo bus factorcaution

One contributor made about 89% of the last three months' commits, creating concentration risk. A second contributor remained active and the repository is organization-owned, which partly mitigates handoff risk.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations less transparent.

Token permissionscaution

Eleven of 12 workflows lack top-level token permissions, none declare read-only permissions, and one workflow has top-level write access. This is a meaningful CI privilege-hardening gap.