antfu

No direct malware or malicious payload is present. The primary supply-chain risk is delegation to mutable external GitHub reusable workflows, especially the release workflow with package publishing, repository write, and OIDC token permissions. Pin reusable workflows to reviewed commit SHAs and review or constrain release permissions where practical.