use-intl

Repo package mentioncaution

The linked repository name differs from use-intl and its README does not mention the package. The mismatch can be normal for a monorepo, but the lack of a package mention leaves ownership linkage less transparent.

Repo toolingcaution

The project uses established build tooling, but no security-scanning tools were detected, leaving a modest transparency and defense-in-depth gap.

Security policycaution

No repository security policy was found, which makes vulnerability reporting and coordinated disclosure less clear for a widely used library.

Workflow auditcaution

All 16 action references are unpinned, and high-confidence template-injection findings appear in release.yml; however, there are no untrusted checkouts or script-injection findings, and the pull_request_target trigger has no reported sink.