zod-from-json-schema

Repo toolingcaution

The project uses TypeScript, Vitest, npm scripts, and esbuild, but no security-scanning tool was detected; this is a modest security-process gap rather than an abandonment concern.

Security policycaution

The repository has no security policy, which makes vulnerability reporting and disclosure expectations less transparent.

Workflow auditcaution

All five workflow action references are unpinned, and the publish workflow has a high-severity cache-poisoning pattern at low confidence plus a high-confidence adhoc-package installation; there are no untrusted checkouts or script-injection findings, limiting the overall impact.