registry-broker

The workflow is a legitimate publishing workflow but contains significant supply-chain security weaknesses. Direct interpolation of workflow_dispatch inputs into Bash can permit command injection, and the arbitrary api-base-url override may expose registry credentials to an attacker-controlled service. Broad GitHub write permissions amplify the impact of compromise. The external action is commit-pinned, but its implementation is not provided and should be independently audited; inputs should be passed through environment variables or safely quoted, endpoints allowlisted, and permissions minimized.

This workflow intentionally exposes the RB API key by placing it in a downloadable GitHub Actions artifact. It should not be used. The secret should be rotated and the workflow and any resulting artifact should be removed or access-restricted. The code is readable and not obfuscated, but the credential disclosure behavior presents a high security risk.

This workflow directly exposes the NPM publishing token by uploading it as a GitHub Actions artifact. It should be treated as a credential exfiltration or secret-disclosure mechanism unless this export is explicitly intended and tightly access-controlled. The NPM token should be revoked or rotated if the workflow has been executed, and the workflow should be removed or changed to avoid persisting secrets in artifacts.