mqtt

Dangerous workflowscaution

One of six workflows uses pull_request_target, which can require careful handling of untrusted contributions, although no untrusted checkout or script-injection patterns were detected.

Lifecycle scriptscaution

A prepare script runs during installation or package preparation, which adds some supply-chain exposure, but this is not by itself evidence of an unsafe release.

Repo toolingcaution

The repository uses established build tooling including TypeScript, webpack, Vite, esbuild, and npm scripts, but no security scanning tools were detected. The build setup is healthy, while the missing scanning is a modest transparency gap.

Security policycaution

No repository security policy was found, leaving vulnerability reporting and response expectations less explicit for a widely used library.

Token permissionscaution

Five of six workflows lack top-level token permissions declarations, reducing clarity about least-privilege automation even though none declares top-level write permissions.