svelte-check

Repo package mentioncaution

The repository name does not match svelte-check and its README does not mention the package, which creates some uncertainty about package-to-repository identity. Because the repository is a substantial organization-owned language-tools monorepo, the mismatch is less concerning than it would be for an unrelated repository.

Repo toolingcaution

The project uses TypeScript and npm scripts, but no security-scanning tools were detected. This is a modest process gap, partially outweighed by the repository's activity and security policy.

Workflow auditcaution

All 16 analyzed action references are unpinned, and the audit found a high-confidence template-injection issue plus low-severity ad hoc package installs. The workflows use read-only permissions and have no untrusted checkout or script-injection trigger, so these are workflow hygiene concerns rather than a standalone severe health risk.