@electron/notarize

Lifecycle scriptscaution

The package uses prepack and prepare lifecycle scripts, which add install and publication complexity; no provided signal shows those scripts are unsafe, so this is a limited supply-chain caution.

Repo bus factorcaution

All three recent commits came from one contributor, with a 100% share, creating concentration risk. Organization ownership partly compensates because maintenance can be handed off internally.

Repo commit activitycaution

The repository recorded three commits in the last three months, showing recent activity but a modest pace for a maintained project.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations less explicit; this is a transparency gap rather than evidence of unsafe code.

Workflow auditcaution

All five workflows were analyzed, use read-only permissions, and pin all 13 action references. High-confidence template-injection findings exist in docs.yml, but no untrusted checkout or script-injection sink was reported, so they remain a hygiene concern rather than a severe workflow risk.