@bufbuild/buf

Build provenancecaution

The package has no registry build attestation, leaving publication provenance less independently verifiable despite GitHub being identified as the trusted publisher.

Dangerous workflowscaution

One workflow uses pull_request_target and one contains a detected script-injection pattern, creating a limited workflow-hardening concern even though no untrusted checkouts were found.

Lifecycle scriptscaution

The postinstall and prepack scripts add install-time behavior, but they are consistent with a package that installs and packages native CLI binaries; the artifact has no runtime dependencies.

Security policycaution

The repository has no published security policy, which makes vulnerability-reporting expectations less transparent.

Token permissionscaution

Six of 16 workflows lack top-level permissions and three declare top-level write access, leaving some workflow privilege boundaries less explicit than ideal.