@electron/fuses

Lifecycle scriptscaution

The package uses prepack and prepare scripts, which add build-time behavior during publishing or installation. No provided signal shows that these scripts are unsafe, so this is a limited supply-chain caution rather than a severe risk.

Repo bus factorcaution

One contributor made all four commits in the last three months, concentrating recent maintenance in a single person. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Security policycaution

The repository has no security policy. This is a transparency gap for reporting and handling vulnerabilities, though the provided security scanning tools partly compensate for it.

Workflow auditcaution

All five workflows were analyzed and all 13 action references are pinned, with read-only permissions in four workflows. However, docs.yml has top-level write permission and two high-confidence template-injection findings; no untrusted checkout or script-injection sink was reported, limiting the impact to workflow hygiene.