@oclif/plugin-warn-if-update-available

Lifecycle scriptscaution

The package defines postpack, prepack, and prepare scripts. These are build and packaging lifecycle hooks, but they add install-time execution surface and merit normal review.

Security policycaution

The repository has no security policy file. This is a transparency gap, although it is partly offset by active organization backing and Dependabot scanning.

Workflow auditcaution

All 7 workflows were analyzed without untrusted checkouts or script injection, and no workflow has top-level write permissions. However, all 11 action references are unpinned, and a high-confidence medium-severity secrets-inherit finding affects onRelease.yml.