wikimedia/language-data

Name lookalikedanger

The package is flagged as borrowing wikimedia/at-ease's identity, with 33% artifact overlap and much lower monthly downloads than the lookalike. Consumers most likely wanted wikimedia/at-ease, making this a severe dependency-selection risk.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response procedures unclear. This is a transparency gap, not evidence of malicious behavior.

Workflow auditcaution

Both workflows were analyzed cleanly with no untrusted checkouts, injection findings, or excessive top-level writes, but all four action references are unpinned. That leaves build inputs less reproducible.