npm-package-publishing

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The provided GitHub Actions workflow templates reference and fetch external actions that are executed at workflow runtime (e.g., uses: actions/checkout@v4 -> https://github.com/actions/checkout, uses: actions/setup-node@v4 -> https://github.com/actions/setup-node, uses: codecov/codecov-action@v4 -> https://github.com/codecov/codecov-action, uses: softprops/action-gh-release@v2 -> https://github.com/softprops/action-gh-release), which run remote code and are required for the CI/release jobs.